PARSEYAML · MAL-2026-18772 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-parseyaml
Reasons (based on the campaign):
The malicious code is intentionally included in a dependency of the package
Downloads and executes a remote malicious script.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.