Skip to content
OpenAdvisories
Malicious MAL-2026-10890 GHSA-2h56-6c2c-2475MAL-2026-6299

analysis-chart

npm package · versions 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28

Reported Jul 20, 2026 · Updated Jul 23, 2026

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Other reports for analysis-chart

  • MAL-2026-6299 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.2… Jun 23, 2026