Live › package › MAL-2025-14109
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-10-29 15:54 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| adorn | npm | all versions | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The package adorn was found to contain malicious code.
-= Per source details. Do not edit below this line.=-
No install-time or import-time behavior of concern was observed in this package version. No lifecycle scripts performing network fetch or shell execution, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment-variable scraping, no hardcoded attacker-controlled network destinations, no obfuscated payloads, and no silent-relay of caller-supplied data were identified.
This page as .md · .json · in your agent: get_signal("MAL-2025-14109")