The npm package @afound/common versions 10.10.11 and 10.10.12 contain malicious code. This is identified as a malicious package incident without detailed technical specifics or CVSS scoring. No known exploits in the wild have been reported, and no official patch or remediation guidance is provided in the available data.