@vf-org/smapi-js-core

MAL-2025-22

Malicious code in @vf-org/smapi-js-core (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: ossf-package-analysis (bb778953ccadf1ddd3d3249677a4b7c27133ddd85d451ebe6cf0e04611264b86)
The OpenSSF Package Analysis project identified '@vf-org/smapi-js-core' @ 8.2.10 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

Compromised versions (10)

8.2.0
8.2.8
8.2.9
8.2.10
8.2.13
8.2.18
8.2.15
8.2.17
8.2.16
8.2.19

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.