npm · Malicious package advisory
Malwarefanduel
MAL-2026-3334
Malicious code in fanduel (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b2d9b4e8ab1ef054d5774929963bc61b004f7914e48179850c51f77e67410a41) The package fanduel was found to contain malicious code. ## Source: ossf-package-analysis (49d980743cd761f6fb629d32e14864e720d1269e4208ec9e0f075c5e9f6eb433) The OpenSSF Package Analysis project identified 'fanduel' @ 100.5.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Compromised versions (1)
- 100.5.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.