VulnerabilityPublished 3 Mar 2025Updated 1 Sep 2026

@ag2rlamondiale/ag2rlm-lib (npm) · Malicious Code

Affects @ag2rlamondiale/ag2rlm-libSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 8 Sep 2026, 03:53 UTC

What to do

Affected software

Product	Affected	Fixed in
npm@ag2rlamondiale/ag2rlm-lib`pkg:npm/%40ag2rlamondiale/ag2rlm-lib`Other threats	Affected =8.3.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Users should avoid using version 8.3.0 of @ag2rlamondiale/ag2rlm-lib. Consider removing or replacing this package version from projects and monitoring for vendor advisories or updates addressing this issue.

Description

The npm package @ag2rlamondiale/ag2rlm-lib version 8.3.0 contains malicious code. This is identified as a malicious package incident without detailed technical or impact information. No patch or remediation guidance is provided in the available data.

Impact

The presence of malicious code in the specified package version implies potential compromise of systems that install and use this package. However, specific impacts such as data theft, system compromise, or other effects are not detailed in the provided information.

Summary

The npm package @ag2rlamondiale/ag2rlm-lib at version 8.3.0 has been identified as containing malicious code. The information is sourced from the GCVE database and OSV entry MAL-2025-1683, with an alias GHSA-7644-48xf-qcmf. There are no CVSS scores, no known exploits in the wild, and no vendor advisories or patches referenced. The threat is classified as a malicious package within the npm ecosystem.

References

github.com/advisories/GHSA-7644-48xf-qcmf (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 03:53 UTC

Technical details

References

Community reviews