OpenSSF/OSV advisory MAL-2026-3395 confirms this npm version as malicious. The package coral-dev-proxy was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in coral-dev-proxy (npm)
Details
The package coral-dev-proxy was found to contain malicious code.
## Source: ossf-package-analysis (43201e77d986713200b2c3f3de10a94b94d87a3d86183e8c6a203533fc32346f) The OpenSSF Package Analysis project identified 'coral-dev-proxy' @ 99.9.2 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms coral-dev-proxy@99.9.3 as malicious (MAL-2026-3395): Malicious code in coral-dev-proxy (npm)