VYPR

npm · Malicious package advisory

Malware

fanduel

MAL-2026-3334

Malicious code in fanduel (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b2d9b4e8ab1ef054d5774929963bc61b004f7914e48179850c51f77e67410a41)
The package fanduel was found to contain malicious code.

## Source: ossf-package-analysis (49d980743cd761f6fb629d32e14864e720d1269e4208ec9e0f075c5e9f6eb433)
The OpenSSF Package Analysis project identified 'fanduel' @ 100.5.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 100.5.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.