OpenSSF/OSV advisory MAL-2026-3416 confirms this npm version as malicious. The package apple-mycelium-fix was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in apple-mycelium-fix (npm)
Details
The package apple-mycelium-fix was found to contain malicious code.
## Source: ossf-package-analysis (a64eb5f60a8d57bd23e8b18ceeea76083900d2400329d2e68d47e5264e6d76ab) The OpenSSF Package Analysis project identified 'apple-mycelium-fix' @ 1.2.1778333524 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms apple-mycelium-fix@1.8.1778336376 as malicious (MAL-2026-3416): Malicious code in apple-mycelium-fix (npm)