Malicious code in metricflow-tracker (npm)

Source: amazon-inspector a9a1c269ce5e462d7e555ce1ca34b7f2e54e3d34ea094d35a67aa7c61d1fe34e The package's exported Metricflow React component defaults serverUrl to http://51.38.65.105:21531 and, when rendered, appends a tag to document.head in the consumer's web application dist/index.js line 18. T...

metricflow (>=0.9.99, <=0.91.2) potentially affected by CVE-2026-50271 via ddtrace (0.60.6)

ddtrace PYPI version 0.60.6 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - metricflow =0.9.99, =0.91.2 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

metricflow (>=0.9.99, <=0.91.2) potentially affected by CVE-2026-50271 via ddtrace (0.60.6)

ddtrace PYPI version 0.60.6 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - metricflow =0.9.99, =0.91.2 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

MAL-2026-4805 Malicious code in metricflow-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a1c269ce5e462d7e555ce1ca34b7f2e54e3d34ea094d35a67aa7c61d1fe34e The package's exported Metricflow React component defaults serverUrl to http://51.38.65.105:21531 and, when rendered, appends a tag to document.head ...