OpenSSF/OSV advisory MAL-2026-3809 confirms this npm version as malicious. The package @tc-core/campus-service was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @tc-core/campus-service (npm)
Details
The package @tc-core/campus-service was found to contain malicious code.
## Source: ossf-package-analysis (9bbf1badd9e8d2be29855017cbd2d690f33885c0884c653412d7d4e463656494) The OpenSSF Package Analysis project identified '@tc-core/campus-service' @ 0.0.0-defensive-callback (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms @tc-core/campus-service@0.0.0-defensive-callback as malicious (MAL-2026-3809): Malicious code in @tc-core/campus-service (npm)