VYPR
← All malware advisories

npm · Malicious package advisory

Malware

ancestry-unified-logger

MAL-2025-190549

Malicious code in ancestry-unified-logger (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (654a8c92f4dee2f432b77c84c15e3926d913e506e58375a0958c08cc53ff134b)
The package ancestry-unified-logger was found to contain malicious code.

## Source: ossf-package-analysis (033a3d4c8fd60d382fb8c44c9b87b597e54b466b0cfa91d7b910726eee601680)
The OpenSSF Package Analysis project identified 'ancestry-unified-logger' @ 85.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 85.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.