VYPR
← All malware advisories

npm · Malicious package advisory

Malware

common-roles

MAL-2026-3308

Malicious code in common-roles (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f602ee3e4db38c8befaab761a5f06c83f1a48c33822478a3ae25e315fcd337a2)
The package common-roles was found to contain malicious code.

## Source: ossf-package-analysis (aec58e59cdd165705f080c8c63baf85d77c4f3b0bc9d1b781695cad976943df0)
The OpenSSF Package Analysis project identified 'common-roles' @ 99.1.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 99.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.