MAL-2025-6829

    Dashboard / Malicious Package / MAL-2025-6829

    MAL-2025-6829

    Published: 12 Aug 2025Last Modified: 19 Mar 2026Aliases: 
    SNYK-JS-TENSORFLOWJS-12670374

    Summary: Malicious code in tensorflowjs (npm)

    Details: Package is malicious due to code obfuscation, arbitrary command execution via `child_process.spawn`, and suspicious `postinstall` script.

    References: https://platform.safedep.io/community/malysis/01K2EEBXJG6ZXTYAZ2CV90XY3C, https://platform.safedep.io/community/malysis/01K2EEBXJG6ZXTYAZ2CV90XY3C, https://safedep.io/malicious-npm-package-targeting-tensorflow-users, https://security.snyk.io/vuln/SNYK-JS-TENSORFLOWJS-12670374

    Affected packages

    Package

    Name: tensorflowjs

    Purl: pkg:npm/tensorflowjs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.6.8
    0.6.9
    MAL-2025-6829 | CVE-DB