PT-2025-55068

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

Malicious code in tree-sitter-pkl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5692ca694e95779acafae807b9a6cd3b419e1b284ff21a64c2b91025f525de06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-253 Malicious code in tree-sitter-pkl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5692ca694e95779acafae807b9a6cd3b419e1b284ff21a64c2b91025f525de06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...