focusync-custom-controls (npm) · Malicious Code
Affects focusync-custom-controlsSource GCVE Database
Malicious package : remove focusync-custom-controls and rotate any secrets on hosts that installed it.
Data as of 4 Nov 2026, 17:16 UTC
Malicious package
Published to npm · OSV MAL-2025-49392
What to do
Remove focusync-custom-controls from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmfocusync-custom-controls | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (83979de8b383c0a28ec2fea476c2842bafabcb6e5abfe06e4253a9c1ab713234) The package focusync-custom-controls was found to contain malicious code. ## Source: ossf-package-analysis (c2933d1e3c5526eaf0618f3fdb8efeebece10a42e18a3091cb585154c38f9a8c) The OpenSSF Package Analysis project identified 'focusync-custom-controls' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.