npm · Malicious package advisory
Malware@plentyofcode/reef
MAL-2024-9024
Malicious code in @plentyofcode/reef (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (b990437e587fd2474b5000fd9f707f0e84e18f3c7dcea47121c3c8e8d28c2316) The OpenSSF Package Analysis project identified '@plentyofcode/reef' @ 1.1.263 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
Compromised versions (3)
- 1.1.259
- 1.1.263
- 1.1.266
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.