MAL-2025-190620

    Dashboard / Malicious Package / MAL-2025-190620

    MAL-2025-190620

    Published: 22 Nov 2025Last Modified: 24 Nov 2025

    Summary: Malicious code in lyft-ui (npm)

    Details: Source: amazon-inspector (70fc3f07a26106b927cf0e4fc2f5f7692c8392b48700359bccb2618bc1ac1565) The package lyft-ui was found to contain malicious code. Source: ossf-package-analysis (1eca95468591ff582df3fadd1de8f6ffef5eb00720afbd1a511b5ea75ab55600) The OpenSSF Package Analysis project identified 'lyft-ui' @ 85.8.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: lyft-ui

    Purl: pkg:npm/lyft-ui

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    85.8.0
    MAL-2025-190620 | CVE-DB