Malicious
OSV ID
MAL-2025-14109
Ecosystem
npm
Summary
No install-time or import-time behavior of concern was observed in this package version. No lifecycle scripts performing network fetch or shell execution, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment-variable scraping, no hardcoded attacker-controlled network destinations, no obfuscated payloads, and no silent-relay of caller-supplied data were identified.
Source: amazon-inspector (2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.