MAL-2026-2410

    Dashboard / Malicious Package / MAL-2026-2410

    MAL-2026-2410

    Published: 24 Mar 2026Last Modified: 16 Apr 2026

    Summary: Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm)

    Details: Malicious post-install script combined with low project popularity indicates potential malware. Arbitrary code execution is a major concern. Source: amazon-inspector (3ebe31c5bb51c354ed83627a02c11ca4c8541e042623b1b987255941ffafdaff) The package @the-coca-cola-company/ngps-global-common-utils was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KHR2P4NQM7HJ6KMSCJ3DCMCX, https://app.safedep.io/community/malysis/01KHR2P4NQM7HJ6KMSCJ3DCMCX, https://safedep.io/sl4x0-dependency-confusion-campaign

    Affected packages

    Package

    Name: @the-coca-cola-company/ngps-global-common-utils

    Purl: pkg:npm/%40the-coca-cola-company/ngps-global-common-utils

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0