Malicious code in @nstudio/xplat (npm)

🗓️ 15 Sep 2025 22:28:48Reported by OSSF Malicious PackagesType

ossf🔗 github.com👁 4 Views

Malicious code in the node package @nstudio/xplat compromises devices; rotate secrets from another machine and remove it.

Vulners

Node

npm @nstudio/xplatRange20.0.4–20.0.7

Source	Link
github	www.github.com/advisories/GHSA-7vxv-2f52-3p74
wiz	www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
semgrep	www.semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/
aikido	www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again
stepsecurity	www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
socket	www.socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

17 Sep 2025 06:23Current

6.9Medium risk

Vulners AI Score6.9