OpenSSF/OSV advisory MAL-2026-3352 confirms this npm version as malicious. The package carbonite-internal was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in carbonite-internal (npm)
Details
The package carbonite-internal was found to contain malicious code.
## Source: ossf-package-analysis (9187d7e1d292c21fa0cb37a0ef02fbc1ebcd489eb60d2bc753329f0f27d275ee) The OpenSSF Package Analysis project identified 'carbonite-internal' @ 99.9.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms carbonite-internal@99.9.0 as malicious (MAL-2026-3352): Malicious code in carbonite-internal (npm)