Malicious code in @combinezone/core (npm)

The @combinezone/core package on npm versions 99.9.9 and 99.9.10 have been identified as containing malicious code, classified under MAL-2026-7061 and GHSA-wghh-p8j2-98qc. This represents a supply chain threat where the package itself is malicious rather than a vulnerability in the code. No further technical details or exploit information is provided.

Use of these specific versions of the @combinezone/core package may introduce malicious code into dependent projects, potentially compromising system integrity or security. No active exploitation has been reported, but the presence of malicious code poses a risk to users who install these versions.

Avoid using versions 99.9.9 and 99.9.10 of the @combinezone/core package. Since no patch or fixed version is provided, users should remove or replace these versions with a known safe alternative. Monitor official advisories for updates or remediation guidance.