OpenSSF/OSV advisory MAL-2026-1383 confirms this npm version as malicious. Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependency confusion.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @immuta/pxl-components (npm)
Details
Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependency confusion.
---
## Source: amazon-inspector (03d86f67d7f931d0f720838a4bda33d56a54a5502b29ebe3e1094a984041b7a2) The package @immuta/pxl-components was found to contain malicious code.
Decision reason
OpenSSF Malicious Packages via OSV confirms @immuta/pxl-components@99.99.1 as malicious (MAL-2026-1383): Malicious code in @immuta/pxl-components (npm)