registry / api-typings / 100.2.0

api-typings@100.2.0

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3329 confirms this npm version as malicious. The package api-typings was found to contain malicious code.

Advisory

MAL-2026-3329

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in api-typings (npm)

Details

The package api-typings was found to contain malicious code. ## Source: ossf-package-analysis (f599905f33c2cf15b340aefe57ac68d680d21634484fad6e64ac24aa006e8e97) The OpenSSF Package Analysis project identified 'api-typings' @ 100.2.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 3.71 KB of source

Source & flagged code

1 flagged

package.jsonView file

Lines 1-8json

2 "name": "api-typings",

3 "version": "100.2.0",

4 "scripts": {

5 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L5

6 }

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

LowScripts Present

LowNo License