Vulnerability	Vulnerable Version
C Embedded Malicious Code Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet removed from the official package manager. A postinstall hook with Python payload was added that actively harvests npm authentication tokens from the victim's machine. How to fix Embedded Malicious Code? Avoid using all malicious instances of the `@opengov/ppf-backend-types` package.	=1.141.2

Embedded Malicious Code

Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet removed from the official package manager.

A postinstall hook with Python payload was added that actively harvests npm authentication tokens from the victim's machine.

How to fix Embedded Malicious Code?

Avoid using all malicious instances of the @opengov/ppf-backend-types package.

=1.141.2

Go back to all versions of this package