f0-service-manager

GHSA-mph3-8rm9-m2wx

Malicious code in f0-service-manager (npm)

Details

**Severity:** Critical

**Affected versions:** `= 4.1.0`

## Source: ossf-package-analysis (3c1c79e59e1f33e79ec5042730e0bfb49f02f35acd0399884dbdac006aebcbbd)
The OpenSSF Package Analysis project identified 'f0-service-manager' @ 4.1.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/71b5ccd62809b0f6e173eff59b5900130cf7fc02/osv/malicious/npm/f0-service-manager/MAL-2025-6866.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/71b5ccd62809b0f6e173eff59b5900130cf7fc02/osv/malicious/npm/f0-service-manager/MAL-2025-6866.json
- https://github.com/advisories/GHSA-mph3-8rm9-m2wx

Compromised versions (1)

= 4.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.