MAL-2025-40351 Malicious code in yarn.lock (npm)

The package yarn.lock was found to contain malicious code...

@pagopa/io-react-native-wallet (>=1.2.2, <=1.5.0), @repay/eslint-config (0.1.1) +9 more potentially affected by unknown CVE via yarn.lock (0.0.1-security)

yarn.lock NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on yarn.lock and may be impacted: - @pagopa/io-react-native-wallet =1.2.2, =1.0.0, =2.14.0-beta.33f459cf.046a621, =4.2.0, =2.7.0, =2.0.29, =1.0.5, =0.1.0, =1.2.0, =1.2.5...