OpenSSF/OSV advisory MAL-2026-3338 confirms this npm version as malicious. The package ms.analytics-web was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ms.analytics-web (npm)
Details
The package ms.analytics-web was found to contain malicious code.
## Source: ossf-package-analysis (35249931468fd68291141567ae436b4220f12fa0498d330bfc75ee82c772c1e7) The OpenSSF Package Analysis project identified 'ms.analytics-web' @ 99.9.13 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms ms.analytics-web@99.9.13 as malicious (MAL-2026-3338): Malicious code in ms.analytics-web (npm)