The npm package 'globby-legacy' version 20.0.1 was found to contain malicious code that communicates with a domain linked to malicious activity. This behavior classifies the package as malicious software. No CVSS score or detailed impact metrics are available.