VYPR
← All malware advisories

npm · Malicious package advisory

Malware

whatnot-manifests

MAL-2026-1582

Malicious code in whatnot-manifests (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2f0504ddd24de9ec3870bb8fc657436f5a61e3f6327f0e044bc380bfe3479d40)
The package whatnot-manifests was found to contain malicious code.

## Source: ossf-package-analysis (050ffab3343a46b5adab9d17bf1d817086d336b52579f1f9c416e05355707873)
The OpenSSF Package Analysis project identified 'whatnot-manifests' @ 99.0.4 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 99.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.