Malware advisory
MAL-2026-6672
Malicious code in ulid-xyz (npm)
3 affected releases in the PkgRadar corpus · published 2026-06-29 · upstream advisory
Affected packages
Every release listed here is malicious per this advisory and is blocked at the CI gate. The Static scancolumn is PkgRadar’s independent static-analysis result for that release — some malicious releases score low on static signals alone, which is why we also mirror the advisory as authoritative.