The OpenSSF Package Analysis project flagged 'proton-pfff' version 99.99.5 as malicious due to its communication with domains tied to malicious activity and execution of commands indicative of malicious intent. This package is distributed via crates.io and is considered a supply chain threat. No CVSS score or detailed vulnerability metrics are provided, and no vendor advisory or patch information is available.

Use of 'proton-pfff' version 99.99.5 may result in execution of malicious commands and communication with malicious domains, potentially compromising systems that incorporate this package. The exact impact depends on the commands executed and the nature of the external communication, but it represents a direct security risk due to its malicious behavior.

No official patch or remediation guidance is available. Users should avoid using 'proton-pfff' version 99.99.5 and remove it from their projects if present. Monitor for updates from the package maintainer or crates.io for any official advisories or removals.