VYPR
← All malware advisories

npm · Malicious package advisory

Malware

xbox-bottomnav

MAL-2025-192604

Malicious code in xbox-bottomnav (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (956281b4efe244dbc01ea826196ee41b5cca6af75d50aa903ecfc4ab5bac134b)
The package xbox-bottomnav was found to contain malicious code.

## Source: ossf-package-analysis (b2d3bdbb6a8dfea031f61b5a839ab2d681218a5b690455f19a91b9bd53d8f507)
The OpenSSF Package Analysis project identified 'xbox-bottomnav' @ 99.99.11 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

  • 99.99.11
  • 99.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.