Malicious
OSV ID
MAL-2026-18365
Ecosystem
npm
Summary
No install-time execution, credential access, network exfiltration, dropper behavior, or backdoor mechanism was observed in this package version. No lifecycle scripts fetching remote content, no reads of installer-side secret paths (~/.aws, ~/.ssh, ~/.npmrc, browser stores), and no hardcoded attacker-controlled network destinations were identified.
Source: amazon-inspector (4987b21d454aad64b26fee42ee36d0d0e2a8b733dc23afbd0c7fe9bb3cd9e631)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.