OpenSSF/OSV advisory MAL-2026-4164 confirms this npm version as malicious. The package identitysecuretokenserv was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in identitysecuretokenserv (npm)
Details
The package identitysecuretokenserv was found to contain malicious code.
## Source: ossf-package-analysis (ca5ba4e9963b86a0d413136370fbfc88c805d09d772ea48ca92c05755f0b05dc) The OpenSSF Package Analysis project identified 'identitysecuretokenserv' @ 10.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms identitysecuretokenserv@20.0.0 as malicious (MAL-2026-4164): Malicious code in identitysecuretokenserv (npm)