yellowcard-styling-config

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (12dee9a88b4f374a8db73de73d255757719bcc1d3124dfe2599b3dbfe3a49d6d)
This package installs a dependency hosted on a custom domain that runs an
info stealer during installation. The info stealer focuses on stealing
npm, git, and other CI/CD related tokens.

## Source: ossf-package-analysis (85a2e473d439da53ddbf091853d2c762d54137a4f23925089435d028f2968dd2)
The OpenSSF Package Analysis project identified 'yellowcard-styling-config' @ 9999.1.1 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

Compromised versions (2)

• 9999.1.1
• 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.