dunnhumby-component-library (npm) · Malicious Code
Affects dunnhumby-component-librarySource GCVE Database
Malicious package : remove dunnhumby-component-library and rotate any secrets on hosts that installed it.
Data as of 4 Nov 2026, 17:16 UTC
Malicious package
Published to npm · OSV MAL-2025-49365
What to do
Remove dunnhumby-component-library from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdunnhumby-component-library | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8b047f32f0323beace719a36eec364b2d804d556202950dae7942b04e2f2b09a) The package dunnhumby-component-library was found to contain malicious code. ## Source: ossf-package-analysis (6da13423e5cb44ae4cf9803a0d05a8827cba013c92c5689216dd8a0f3b3e4d43) The OpenSSF Package Analysis project identified 'dunnhumby-component-library' @ 1.1.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.