Malicious code in pxnpm (npm)
What to do
- Check every lockfile and build cache for the affected versions below and remove them.
- Rotate any secrets (tokens, keys, cloud credentials) that were available to machines that installed them.
- Pin to a known-good version and reinstall from a clean lockfile.
Malicious versions
pxnpm
- = 7.0.0-beta.6
Check your project: npm ls pxnpm --all
pxnpm
- = 7.0.0-beta.8
Check your project: npm ls pxnpm --all
pxnpm
- = 7.0.0
Check your project: npm ls pxnpm --all
pxnpm
- = 7.0.1
Check your project: npm ls pxnpm --all
pxnpm
- = 7.0.2
Check your project: npm ls pxnpm --all