Note: This report is updated by a verification record
osv MAL-2025-6021: Malicious code in @pkgr/core (npm)
Package compromised via npm token leak from phishing attack