Malicious code in @depup/astro (npm)

Source: amazon-inspector c7c6330072ae71974da0dd2e0e72a33334a35b78ec5679536d95b9f205032225 This package is published under the @depup scope but sets author to 'withastro' and repository to github.com/withastro/astro, framing itself as a routine dependency-bump of the upstream astro framework. Its...

Malicious code in astro (npm)

Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolors, debug, and @astrojs/markdown-remark. The package.json...

MAL-2026-10726 Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...