OpenSSF/OSV advisory MAL-2026-3418 confirms this npm version as malicious. The package devsite-youtube was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in devsite-youtube (npm)
Details
The package devsite-youtube was found to contain malicious code.
## Source: ossf-package-analysis (877202a4cdc7e48b1c51134c2d69b1535050faa6c1fdd32c8d8f1eade3a66783) The OpenSSF Package Analysis project identified 'devsite-youtube' @ 99.9.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms devsite-youtube@99.9.0 as malicious (MAL-2026-3418): Malicious code in devsite-youtube (npm)