The OpenSSF Package Analysis project flagged 'proton-pfff' version 99.99.5 as malicious due to its communication with a domain known for malicious activity and execution of commands indicative of malicious behavior. This assessment is based on analysis from the OpenSSF and is documented in the MAL-2026-6959 advisory. No CVSS score is assigned, but the behavior classifies it as a high-severity threat. No patch or remediation is currently documented for this package version.

Users incorporating 'proton-pfff' version 99.99.5 risk exposure to malicious network communications and execution of harmful commands, potentially leading to compromise of the host environment or data exfiltration. The malicious nature of the package undermines trust in the software supply chain for projects depending on this crate.

Avoid using 'proton-pfff' version 99.99.5. Since no official patch or remediation is available, users should remove this package from their dependencies and replace it with trusted alternatives. Monitor dependency sources carefully to prevent inclusion of malicious packages.