VYPR
← All malware advisories

npm · Malicious package advisory

Malware

shop-state

MAL-2026-48

Malicious code in shop-state (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5afad53032ae0acf7c8b481c6f0bd05fc4a1c283de24285d35b19a376cfa1b10)
The package shop-state was found to contain malicious code.

## Source: ossf-package-analysis (d58739af4e37d5036dbdce18541280d73164818a82e7d2de5f2b142a52db2a89)
The OpenSSF Package Analysis project identified 'shop-state' @ 999.1.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

  • 999.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.