This package is flagged as malware in Github Advisory Database.

[mburakeker]

Hi, I just see that this package is reported as malware, any details about this?

https://osv.dev/vulnerability/MAL-2025-47172
GHSA-6wgq-85c7-p729

[mburakeker]

Could this be related to the latest github action runs?

[mburakeker]

After checking the output of that action, it seems that secrets were sent to a website, and you can even see the secrets yourself without even checking the website.

uh @NathanWalker sorry to bear the bad news but I think you got hacked

[mburakeker]

oh-kay I just came across this:
https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

@NathanWalker I think you got affected by this

[NathanWalker]

Should be all clear now, please use this issue to ping if notice anything else suspicious.

[rkajbaf]

https://osv.dev/vulnerability/MAL-2025-47172

says only 2 versions were affected but mend.io is saying due to the nature of the attack, it's possible the entire package history is compromised and warning against using this...

I don't want to have to pull this out of my application if I don't have to. Thoughts?