Malicious code in lowkick (npm)

The package lowkick was found to contain malicious code...

fox (0.0.8), lowkick (>=0.0.1, <=0.1.0) +2 more potentially affected by unknown CVE via combiner (1.2.1)

combiner NPM version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on combiner and may be impacted: - fox 0.0.8 - lowkick =0.0.1, =1.1.0, =0.3.1, =0.3.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-17379...

MAL-2025-25618 Malicious code in lowkick (npm)

The package lowkick was found to contain malicious code...