Live › package › MAL-2026-18338

criticalPackagenpm

Malicious code in @azure-growth/signup-ux-components (npm)

Not triaged yet. The sources’ own description is below.

Known so far

2/6

critical

no CVSS yet; severity from the sources

known so far2 of 6

missing: how to check, fix, exploitation, summary

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 12:01 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
@azure-growth/signup-ux-components	npm	= 1.2.2	–

Who cares: malicious
Not affected if: –

How to check

Unknown from the sources.

The fix

Unknown from the sources.

Who had it, and when

1 source

osv-malicious2026-10-27 12:01 UTC · published 2026-10-27 11:09 UTC · MAL-2026-18338

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

Know the next one before it finds you.

Add to Slack

Live › package › MAL-2026-18338

Go to dashboard

criticalPackagenpm

Malicious code in @azure-growth/signup-ux-components (npm)

Not triaged yet. The sources’ own description is below.

Known so far

2/6

critical

no CVSS yet; severity from the sources

known so far2 of 6

missing: how to check, fix, exploitation, summary

First public: Oct 27, 2026 UTC
Last modified: Oct 27, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-27 12:01 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
@azure-growth/signup-ux-components	npm	= 1.2.2	–

Who cares: malicious
Not affected if: –

How to check

Unknown from the sources.

The fix

Unknown from the sources.

Who had it, and when

1 source

osv-malicious2026-10-27 12:01 UTC · published 2026-10-27 11:09 UTC · MAL-2026-18338

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

Know the next one before it finds you.

Add to Slack

Malicious code in @azure-growth/signup-ux-components (npm)

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

Malicious code in @azure-growth/signup-ux-components (npm)

Who is affected

How to check

The fix

Who had it, and when

Know the next one before it finds you.

What the sources say, verbatim

Source: ossf-package-analysis (d6aa62a9421f736418e09f0b247beb52637c7cb21f03cfba35656222e48215fc)

Sources