MAL-2025-47025

    Dashboard / Malicious Package / MAL-2025-47025

    MAL-2025-47025

    Published: 11 Sept 2025Last Modified: 11 Sept 2025

    Summary: Malicious code in @coveops/abi (npm)

    Details: Source: google-open-source-security (75499720f09aaa0ee53321facfb199f2c3234acabc101127ae22bbd4fa90bb1d) This package was compromised and malicious code added as part of a phishing campaign.

    References: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised, https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/, https://snyk.io/blog/npm-supply-chain-attack-via-open-source-maintainer-compromise/

    Affected packages

    Package

    Name: @coveops/abi

    Purl: pkg:npm/%40coveops/abi

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1