VYPR

npm · Malicious package advisory

Malware

@ra-ftds/ra-flourish-design-tokens

MAL-2025-190588

Malicious code in @ra-ftds/ra-flourish-design-tokens (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f72b65d4ce1abb0b35aca62b21968c19b6e8e99ec60962be31a4179ba5f22bec)
The package @ra-ftds/ra-flourish-design-tokens was found to contain malicious code.

## Source: ossf-package-analysis (5a251361ace071661e36a08fab33db0ff683232d0ff9f6d6d15a1551ade77bf2)
The OpenSSF Package Analysis project identified '@ra-ftds/ra-flourish-design-tokens' @ 43.3.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 43.3.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.