VYPR
← All malware advisories

npm · Malicious package advisory

Malware

a2a-chat-canvas

MAL-2026-2524

Malicious code in a2a-chat-canvas (npm)

Details

Malicious package due to suspicious callback URL, hostname exfiltration, preinstall script execution, and only one published version.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d466a45c588940f8279288c439a4665d5368f0a7642c966de8e9fd307bc028b3)
The package a2a-chat-canvas was found to contain malicious code.