npm · Malicious package advisory
Malwareis
MAL-2025-6020
Malicious code in is (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: google-open-source-security (a1baf574e6278b3c20c30fdd7875414ed04c1a695eb226fd43328004c6916873) "is" had unauthorized new versions published that contained malicious obfuscated code via account compromise.
Compromised versions (2)
- 3.3.1
- 5.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.