MalwarePublished 9 Nov 2025

yanti-gepuk65-riris (npm) · Malicious Code

Affects yanti-gepuk65-ririsSource GCVE Database

Malicious package : remove yanti-gepuk65-riris and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 19:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49630

What to do

Remove yanti-gepuk65-riris from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmyanti-gepuk65-riris	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package yanti-gepuk65-riris was identified as containing malicious code. No specific details about the nature of the malicious code, affected versions, or exploitation are provided.

Impact

The presence of malicious code in the package implies potential risk to systems that install or use this package. However, no specific impact details, such as data compromise or system control, are provided.

Defensive guidance

Users should avoid installing or using the yanti-gepuk65-riris package until further information or remediation is provided by the vendor or npm repository.

Summary

The package yanti-gepuk65-riris, distributed via npm, has been found to include malicious code according to the Amazon Inspector source. There is no additional information on the type of malicious behavior, affected versions, or exploitation status.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 19:10 UTC

Technical details

Community reviews