npm · Malicious package advisory
Malwarelibxmljs2varaboba
MAL-2025-192388
Malicious code in libxmljs2varaboba (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c5238325d9c28808a2213c9d93413847ccb8a9989720c91a2e6f8b161947fda0) The package libxmljs2varaboba was found to contain malicious code. ## Source: ossf-package-analysis (16ad9ea87f573dd90a31d14b711b01971c879f66ff957465239862bd69cf34c7) The OpenSSF Package Analysis project identified 'libxmljs2varaboba' @ 0.30.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Compromised versions (1)
- 0.30.2
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.