Malicious code in mx-frontend (npm)

The 'mx-frontend' package in the npm ecosystem, specifically version 99.9.9, has been identified as containing malicious code. This classification is based on the MAL-2026-7325 OSV entry and the GHSA-9j4c-xcrm-qgrx advisory alias. The information does not include a CVSS score, detailed vulnerability description, or exploit details. No patch or remediation information is provided, and the package is not a cloud service. The threat is categorized as a malicious package rather than a software vulnerability.

The presence of malicious code in the 'mx-frontend' npm package can lead to compromise of systems that install and run this specific version. The exact impact is not detailed, but malicious packages typically risk unauthorized code execution, data theft, or system compromise. No known active exploitation has been reported.

No official patch or remediation guidance is provided. Users should avoid using version 99.9.9 of the 'mx-frontend' package. It is recommended to verify the integrity and source of npm packages before installation and consider removing or replacing this package if already in use.