VYPR

npm · Malicious package advisory

Malware

pocpoc2626

MAL-2026-3328

Malicious code in pocpoc2626 (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4a43e5357592b2bbbe0c68be3960ac829ab988a15b57d63df5ab954c9d0b5b09)
The package pocpoc2626 was found to contain malicious code.

## Source: ossf-package-analysis (0176ec0fde390432553ec3dffa91438e5e923d23549ef4b836bc91de5259a21d)
The OpenSSF Package Analysis project identified 'pocpoc2626' @ 99.99.9998 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

  • 99.99.9998
  • 100.0.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.