is

GHSA-6f4g-3jvw-4j45

Malicious code in is (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.3.1`

## Source: google-open-source-security (a1baf574e6278b3c20c30fdd7875414ed04c1a695eb226fd43328004c6916873)
"is" had unauthorized new versions published that contained malicious
obfuscated code via account compromise.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/05b419acdcdd6e02782971da765f32a22a1aed8e/osv/malicious/npm/is/MAL-2025-6020.json))

**References:**
- https://github.com/enricomarino/is/commit/0fe137a5946e4ecb0e649bd7dea48d5415a242fc
- https://github.com/ossf/malicious-packages/blob/05b419acdcdd6e02782971da765f32a22a1aed8e/osv/malicious/npm/is/MAL-2025-6020.json
- https://github.com/advisories/GHSA-6f4g-3jvw-4j45

Compromised versions (1)

= 3.3.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.