Malicious code in @spinstorm/derng (npm)

The npm package @spinstorm/derng at version 99.99.99 has been identified as containing malicious code. This is classified as a malicious package incident rather than a conventional vulnerability. There is no detailed technical information or vendor advisory available to clarify the nature of the malicious code or its impact. No patch or remediation guidance is provided, and no active exploitation has been reported.

The presence of malicious code in the package could lead to compromise of systems or data if the package is installed and executed. However, no specific impact details or exploitation reports are available. The threat is limited to the specified version of the package.

No official patch or remediation guidance is available. Users should avoid installing or using the affected version (=99.99.99) of the @spinstorm/derng package. Consider removing the package if already installed and monitor for vendor advisories or updates.