MAL-2026-2447

    Dashboard / Malicious Package / MAL-2026-2447

    MAL-2026-2447

    Published: 3 Apr 2026Last Modified: 10 Apr 2026

    Summary: Malicious code in @toprank/partner (npm)

    Details: Source: amazon-inspector (78a6d41a400b329c496f199f979216a151264b95d960a177b3b0347e6b3cf10e) The package @toprank/partner was found to contain malicious code. Source: ossf-package-analysis (5758f4b3b20d628c49a22e4eb09f54e9604d6b00fa68dee107701a175d9fa632) The OpenSSF Package Analysis project identified '@toprank/partner' @ 99.99.11 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @toprank/partner

    Purl: pkg:npm/%40toprank/partner

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.11
    99.99.12
    99.99.13
    MAL-2026-2447 | CVE-DB