OpenSSF/OSV advisory MAL-2026-3315 confirms this npm version as malicious. The package update-db was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in update-db (npm)
Details
The package update-db was found to contain malicious code.
## Source: ossf-package-analysis (188c4543894354956bdb0ef341ed98247a992c1ab7a8873fa6ac1c7533e9b1c0) The OpenSSF Package Analysis project identified 'update-db' @ 99.1.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms update-db@99.1.1 as malicious (MAL-2026-3315): Malicious code in update-db (npm)