MAL-2026-2500

    Dashboard / Malicious Package / MAL-2026-2500

    MAL-2026-2500

    Published: 6 Apr 2026Last Modified: 7 Apr 2026

    Summary: Malicious code in totally-safe-util (npm)

    Details: Multiple suspicious behaviors: postinstall script, hex obfuscation, OS command execution to open a Rickroll, and attempt to hide execution. Source: amazon-inspector (0d45a8a1395a8ff66e2ea74cacd9d8de0ebaa9e88e0170a6907b3e4861a2acc5) The package totally-safe-util was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KNH1FTR1AQ1B6NBEH35N5W9Z

    Affected packages

    Package

    Name: totally-safe-util

    Purl: pkg:npm/totally-safe-util

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions