MAL-2026-1232

    Dashboard / Malicious Package / MAL-2026-1232

    MAL-2026-1232

    Published: 25 Feb 2026Last Modified: 8 Mar 2026

    Summary: Malicious code in @schedaero/yukon (npm)

    Details: Multiple evidences indicate malicious behavior: suspicious URL, data exfiltration, process exiting, and preinstall script execution. Source: amazon-inspector (b02868b7ba4a5e5bf754e692e348191e6974f2f707417f20f97b33f172cda4ca) The package @schedaero/yukon was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KJ9PRVFX88RWKSJR1HD1ME36

    Affected packages

    Package

    Name: @schedaero/yukon

    Purl: pkg:npm/%40schedaero/yukon

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2026-1232 | CVE-DB