---
title: "MAL-2025-6021: Malicious code in @pkgr/core (npm)"
description: "Malicious code in @pkgr/core (npm). Affects @pkgr/core; fixed in 0.3.6."
url: https://inlinr.com/advisories/MAL-2025-6021
lang: en
---

[Packages](https://inlinr.com/packages) / [@pkgr/core](https://inlinr.com/packages/@pkgr/core) / [Security](https://inlinr.com/packages/@pkgr/core/security)

Malicious package MAL-2025-6021 Published 21 Jul 2025

# Malicious code in @pkgr/core (npm)

Your version 

Compromised versions · [@pkgr/core](https://inlinr.com/packages/@pkgr/core)

- 0.2.8

Safe

Every other versionincluding the latest, 0.3.6

```
npm install @pkgr/core@0.3.6
```

1. Not affected

0.1.0 – 0.2.7  
11 releases
2. Affected

0.2.8  
1 release
3. Safe

0.2.9 – 0.3.6  
9 releases, latest

21 stable releases of @pkgr/core, oldest to newest.

## What happens

If one of these versions was installed

1. Treat the machines and CI runners that installed it as compromised.
2. Rotate the npm, GitHub and cloud tokens they could reach.
3. Reinstall from a lockfile that pins a version outside the list.

This package installs a windows based malware file node-gyp.dll via install.js

## References

- [Reference](https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/ "https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/")  
bleepingcomputer.com/news/security/popular-npm-…