Malicious code in meta-templates (npm)

The meta-templates package in the npm ecosystem, specifically versions 1.0.0, 1.0.1, and 1.0.2, has been identified as containing malicious code. This classification is based on the MAL-2026-7319 identifier and the GHSA-jc4j-8gm8-85jh alias. There is no detailed technical description or vendor advisory available to clarify the nature of the malicious code or its exploitation methods.

The presence of malicious code in these package versions could lead to compromise of systems that install or run the affected versions. However, no specific impact details or exploitation reports are available, and no known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal guidance is provided, users should avoid using versions 1.0.0, 1.0.1, and 1.0.2 of the meta-templates package and consider removing or replacing them in their projects.