Malicious code in @datatrain/passenger (npm)

The npm package @datatrain/passenger in versions 9.9.9 and 9.9.10 has been identified as containing malicious code. This classification is based on the OSV entry MAL-2026-7065 and the associated GHSA advisory GHSA-qq8c-7q86-jj9m. No further technical details or exploit information are available from the source. The package is flagged as malicious rather than a conventional vulnerability.

Use of the affected versions of the @datatrain/passenger package may result in the introduction of malicious code into dependent projects. This can lead to potential compromise of systems or data depending on the payload and execution context of the malicious code. No active exploitation has been reported to date.

No official patch or remediation guidance is provided. Users should avoid using versions 9.9.9 and 9.9.10 of the @datatrain/passenger package. Consider removing or replacing the package with a trusted alternative. Monitor official advisories for updates or remediation instructions.