MAL-2025-49389

    Dashboard / Malicious Package / MAL-2025-49389

    MAL-2025-49389

    Published: 7 Nov 2025Last Modified: 9 Nov 2025

    Summary: Malicious code in globby-legacy (npm)

    Details: Source: amazon-inspector (e5dabda4e0dee5eaa0167110e61399509aae53fc96c8c39ebd8b1535e5f4ca15) The package globby-legacy was found to contain malicious code. Source: ossf-package-analysis (325a8ddc606af2d82495e321aa883a481c43c00bfd59d4d2739903380b8926e1) The OpenSSF Package Analysis project identified 'globby-legacy' @ 20.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: globby-legacy

    Purl: pkg:npm/globby-legacy

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    20.0.1