OpenSSF/OSV advisory MAL-2026-3806 confirms this npm version as malicious. The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @citi-icg-158830/elemental-chameleon (npm)
Details
The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
## Source: ossf-package-analysis (584d2e027d86f89b78898d46a4aab1a0bd131897750c876c729e2247b1479a40) The OpenSSF Package Analysis project identified '@citi-icg-158830/elemental-chameleon' @ 0.0.0-defensive-callback.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms @citi-icg-158830/elemental-chameleon@0.0.0-defensive-callback.1 as malicious (MAL-2026-3806): Malicious code in @citi-icg-158830/elemental-chameleon (npm)