icu-messageformat (>=2.0.0 <=2.0.1) potentially affected by unknown CVE via icu-messageformat (=1.0.1)

icu-messageformat NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on icu-messageformat and may be impacted: - icu-messageformat =2.0.0, =2.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-49416...

EUVD-2025-38414

Malicious code in icu-messageformat npm...

Malicious code in icu-messageformat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1fc5a2af1395cc93448f25e96d6c16427b37dfddad7075ec3b9409f012a0346 The package icu-messageformat was found to contain malicious code...

MAL-2025-49416 Malicious code in icu-messageformat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1fc5a2af1395cc93448f25e96d6c16427b37dfddad7075ec3b9409f012a0346 The package icu-messageformat was found to contain malicious code...