atlassian-wallboard-plugin
This report shows the evidence for atlassian-wallboard-plugin@10.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.0-stage, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18437 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The remote tarball dependency chain is unusual, but the available source establishes no attack behavior. The package has no declared lifecycle or entry point, so treat this as an unresolved dependency risk and warn rather than block.
Independent scan evidence
public snapshot- The manifest depends on node-ac2 from a GitHub tarball URL.
- The prepared node-ac2 manifest declares a second dependency from the same GitHub repository.
- The prepared claims-ac1 manifest also depends on the node-ac2 tarball.
- The package manifest declares no lifecycle scripts, bin, main, or exports entry points.
- The available snapshot contains only dependency manifests, with no executable source to establish what the tarballs do.
Source & flagged code
4 flaggedThe manifest depends on node-ac2 from a GitHub tarball URL.
package.jsonView on unpkg · L1Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to atlassian-wallboard-plugin@10.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing atlassian-wallboard-plugin@10.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.