npm · Malicious package advisory
Malware@ra-ftds/ra-flourish-design-tokens
MAL-2025-190588
Malicious code in @ra-ftds/ra-flourish-design-tokens (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f72b65d4ce1abb0b35aca62b21968c19b6e8e99ec60962be31a4179ba5f22bec) The package @ra-ftds/ra-flourish-design-tokens was found to contain malicious code. ## Source: ossf-package-analysis (5a251361ace071661e36a08fab33db0ff683232d0ff9f6d6d15a1551ade77bf2) The OpenSSF Package Analysis project identified '@ra-ftds/ra-flourish-design-tokens' @ 43.3.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Compromised versions (1)
- 43.3.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.