subapp-pkg-util

GHSA-p447-52h5-jvxq

Malicious code in subapp-pkg-util (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.1`

## Source: ossf-package-analysis (9ec05191ebd2f02dcf912c49fc5d345c3b9201fb691a11a0142fec91cc6d42d4)
The OpenSSF Package Analysis project identified 'subapp-pkg-util' @ 99.0.1 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a2535f75a691226090f19962abb0f92a3fe26f3c/osv/malicious/npm/subapp-pkg-util/MAL-2026-11045.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a2535f75a691226090f19962abb0f92a3fe26f3c/osv/malicious/npm/subapp-pkg-util/MAL-2026-11045.json
- https://github.com/advisories/GHSA-p447-52h5-jvxq

Compromised versions (1)

= 99.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.