Malicious code in @public-for-cdao/core (npm)

The npm package @public-for-cdao/core at version 99.99.99 has been identified as containing malicious code, classified under the identifier MAL-2026-10885 and alias GHSA-gpx4-hq9v-733f. There are no known exploits in the wild and no patch or remediation information is available. The threat is categorized as a malicious package within the npm ecosystem.

The presence of malicious code in the specified package version could lead to compromise of systems that install or use this package. Specific impacts are not detailed in the provided data. No active exploitation has been reported.

No patch or remediation guidance is provided. Users should avoid using the affected version (=99.99.99) of the @public-for-cdao/core package. Consider removing or replacing this package with a trusted alternative. Monitor vendor or repository advisories for updates.