npm
Malicious nitroping @0.2.14
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2025-191134
Ecosystem
npm
Summary
No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package version. There is no evidence of credential access, environment scraping, install/import-time network fetch-and-execute, silent-relay of caller data to a hardcoded endpoint, persistence, or dropper behavior in the analyzed contents.
Source: amazon-inspector (ab13b3f9a9100541d146c2728a90d45bfe20125de13d0f39196f03259918c1b9)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.