MAL-2026-2409

    Dashboard / Malicious Package / MAL-2026-2409

    MAL-2026-2409

    Published: 24 Mar 2026Last Modified: 7 Apr 2026

    Summary: Malicious code in @phonos/types (npm)

    Details: Multiple evidences indicate malicious behavior: obfuscation, suspicious install script, access to sensitive functionalities, and untrustworthy source. Source: amazon-inspector (e8c10ea271203f85e595559214b08565cef54710fcc605eca02483606041cf51) The package @phonos/types was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KMFH5QXA5XN5HBCJ8P0VKAAX

    Affected packages

    Package

    Name: @phonos/types

    Purl: pkg:npm/%40phonos/types

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions