Packages / @pkgr/core / Security

Malicious packageMAL-2025-6021Published 21 Jul 2025

Malicious code in @pkgr/core (npm)

Your version

Compromised versions · @pkgr/core

  • 0.2.8

Safe

Every other versionincluding the latest, 0.3.6

npm install @pkgr/core@0.3.6

  1. Not affected

    0.1.0 – 0.2.7

    11 releases

  2. Affected

    0.2.8

    1 release

  3. Safe

    0.2.9 – 0.3.6

    9 releases, latest

21 stable releases of @pkgr/core, oldest to newest.

What happens

If one of these versions was installed

  1. Treat the machines and CI runners that installed it as compromised.
  2. Rotate the npm, GitHub and cloud tokens they could reach.
  3. Reinstall from a lockfile that pins a version outside the list.

This package installs a windows based malware file node-gyp.dll via install.js