Malicious Package

Overview subapp-pkg-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in subapp-pkg-util

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview subapp-pkg-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in subapp-pkg-util (npm)

Source: ossf-package-analysis 9ec05191ebd2f02dcf912c49fc5d345c3b9201fb691a11a0142fec91cc6d42d4 The OpenSSF Package Analysis project identified 'subapp-pkg-util' @ 99.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

MSC-2026-6373

Malicious npm package: dependency-confusion takeover proof-of-concept. Published as [email protected] artificially high major to win dependency resolution while its code self-identifies as the internal package electrode-ota-ui-app and is labelled 'Takeover by L0bo'. On install postinstall:...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

MAL-2026-11045 Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...