Malicious code in f0-form-manipulator (npm)
Affects f0-form-manipulatorSource GCVE Database
Data as of 07/25/2026, 23:44:45 UTC
Rated by Threat Radar
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmf0-form-manipulator | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until then, avoid using 'f0-form-manipulator' version 28.0.0 and consider removing it from projects. Monitor official sources for updates or safe versions.
Description
The npm package 'f0-form-manipulator' version 28.0.0 has been identified as malicious by the OpenSSF Package Analysis project. The package is considered malicious because it communicates with a domain associated with malicious activity. There is no CVSS score available for this threat. No known exploits in the wild have been reported. No patch or remediation information is provided.
Impact
Use of the malicious package version 28.0.0 may expose users to risks associated with communication to malicious domains, potentially leading to data exfiltration or other malicious activities. However, no specific exploit or impact details are provided.
Summary
The 'f0-form-manipulator' package at version 28.0.0 on npm is flagged as malicious due to its communication with a domain linked to malicious behavior. This identification comes from the OpenSSF Package Analysis project, which monitors open source packages for security issues. No further technical details or exploit information are available.