OpenSSF/OSV advisory MAL-2026-5623 confirms this npm version as malicious. The package was found to contain malicious code or consuming dependency that contains malicious code
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in edu-npm-dependency-chain-demo (npm)
Details
The package was found to contain malicious code or consuming dependency that contains malicious code
## Source: ossf-package-analysis (5a2508b833cc9048538d7b995e19fdc3abb6807800a2650ef808f248a3502139) The OpenSSF Package Analysis project identified 'edu-npm-dependency-chain-demo' @ 1.0.4 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms edu-npm-dependency-chain-demo@1.0.4 as malicious (MAL-2026-5623): Malicious code in edu-npm-dependency-chain-demo (npm)