OpenSSF/OSV advisory MAL-2026-3423 confirms this npm version as malicious. The package byvendors was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in byvendors (npm)
Details
The package byvendors was found to contain malicious code.
## Source: ossf-package-analysis (1b7d770b773df64355a4fac410adc86f9778e470efdcc18ede73eb6024a3f982) The OpenSSF Package Analysis project identified 'byvendors' @ 99.0.6 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms byvendors@99.0.6 as malicious (MAL-2026-3423): Malicious code in byvendors (npm)