Malicious import


An open-source package that attempts to install a known malicious package could be a software component or library that, when executed or included in a software project, initiates actions to download and install another package that is recognized as being malicious or harmful. This behavior may be performed intentionally by the package author or may be the result of compromised or unauthorized modifications to the package code or dependencies.


Malicious actors may attempt to conceal the true intent of the open-source package by obfuscating or disguising the code responsible for initiating the installation of the malicious package.
The installation of known malicious packages poses significant security risks to users and organizations, including exposure to malware, data breaches, financial losses, reputational damage, and legal liabilities.


Remove the package from your dependencies list, disconnect affected devices from the network and report the incident to the relevant authorities in your organization.