0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
redis-type-xyz
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting redis-type-xyz, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-11205 | Unknown | Malicious code in redis-type-xyz (npm)The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency list replaces the legitimate ulid package used by Redis OM with ulid-xyz@^2.12.2. Installing redis-type-xyz therefore installs the known-malicious ulid-xyz dependency. The ulid-xyz postinstall hook launches a detached background agent that decodes a WebSocket and HTTP C2 endpoint at 95.216.232.162:8010. |
| OSV (opens in a new tab) |
The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency list replaces the legitimate ulid package used by Redis OM with ulid-xyz@^2.12.2. Installing redis-type-xyz therefore installs the known-malicious ulid-xyz dependency. The ulid-xyz postinstall hook launches a detached background agent that decodes a WebSocket and HTTP C2 endpoint at 95.216.232.162:8010.