MAL-2025-7057 Malicious code in @amber-team/figma-utils (npm)

The package @amber-team/figma-utils was found to contain malicious code...

MAL-2025-17335 Malicious code in com.microsoft.mixedreality.toolkit.figmabridge (npm)

The package com.microsoft.mixedreality.toolkit.figmabridge was found to contain malicious code...

MAL-2025-20521 Malicious code in figma-to-streamlit (npm)

The package figma-to-streamlit was found to contain malicious code...

MAL-2025-20520 Malicious code in figma-api-spellcheck (npm)

The package figma-api-spellcheck was found to contain malicious code...

Malicious code in pexels-figma (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in figma-plugins-and-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 250144845a9dd4a7a0bea8a44c06f50652890d4ab2f0fb860bb51a5a14ea1a54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1647 Malicious code in figma-plugins-and-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 250144845a9dd4a7a0bea8a44c06f50652890d4ab2f0fb860bb51a5a14ea1a54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in figma-include-accessibility-annotations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcb17fd8a376f1c1967e4a54049e96bf34f63f71f41e75262db53f96e883d43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in figma-include-accessibility-annotations

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8719 Malicious code in figma-include-accessibility-annotations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcb17fd8a376f1c1967e4a54049e96bf34f63f71f41e75262db53f96e883d43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in figma-ping (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebe1815dd250b41e64f2909a2e5146f9cd629767dda41d0a8b14058b18463501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-440 Malicious code in figma-ping (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebe1815dd250b41e64f2909a2e5146f9cd629767dda41d0a8b14058b18463501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview pexels-figma is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview polaris-for-figma is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in base-figma-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0dd9075841d7abcb71ab19a2b5e2295a1a261b1570271b5f2e399f49337eb37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbsystem/figma-intern-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89d273e9459a52f8724d5b65339a1a5e171ff28e3f44bba89b71c6ffdd0c5142 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbsystem/figma-messenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71addafc4195bb495c6b65e56d535eb02c90e7fdc06b56a35ca98d98555c644a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-268 Malicious code in @fbsystem/figma-messenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71addafc4195bb495c6b65e56d535eb02c90e7fdc06b56a35ca98d98555c644a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbsystem/figma-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffcdcbc9429c0fa805533c9d10c14de74d0e13ff69d006e033802a11ac00733b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-266 Malicious code in @fbsystem/figma-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffcdcbc9429c0fa805533c9d10c14de74d0e13ff69d006e033802a11ac00733b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...