VYPR
← All malware advisories

npm · Malicious package advisory

Malware

mms-ref-client

GHSA-p4x2-g83h-x323

Malicious code in mms-ref-client (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1-security`

## Source: amazon-inspector (2b3d204e0f49cb41d203a04419909bce2a366f33ab7859b4e1977374ec1db93e)
The package mms-ref-client was found to contain malicious code.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/42f23034303701eb78d0a10c70cc3c99bc8034bb/osv/malicious/npm/mms-ref-client/MAL-2025-49227.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/42f23034303701eb78d0a10c70cc3c99bc8034bb/osv/malicious/npm/mms-ref-client/MAL-2025-49227.json
- https://github.com/advisories/GHSA-p4x2-g83h-x323

Compromised versions (1)

  • = 0.0.1-security

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.