NPM package removed due to malicious code

[mogzol]

The NPM package (https://www.npmjs.com/package/@umpirsky/country-list) was removed because it apparently "contained malicious code". Clicking the link for more information on that page just gives a 404 though, so I couldn't find any more details. Does anyone know why this happened or if the package will ever be added back to NPM?

[umpirsky]

No idea, I can't login.Trying to recover password, but recovery link never gets delivered.

[yariksheptykin]

Hello from 2026. We were accused by grype (https://github.com/anchore/grype) of having a critical security vulnerability "GHSA-hj79-42mx-m4gr" (GHSA-hj79-42mx-m4gr) related to this package.

+ ./grype my/docker/image:latest
NAME                                 INSTALLED   FIXED IN         TYPE          VULNERABILITY        SEVERITY  EPSS           RISK   
@umpirsky/country-list               1.0.0                        npm           GHSA-hj79-42mx-m4gr  Critical  N/A            N/A    
github.com/go-viper/mapstructure/v2  v2.2.1      2.3.0            go-module     GHSA-fv92-fjc5-jj9h  Medium    N/A            N/A

grype scanned the entire filesystem for package.json and found inside this composer package. It then looked up the CVE database for this npm package and reported an error. It looks like someone gained control over umpirsky username on npm and published a malicious package under umpirsky/country-list.

To stop confusing security scanning tools, @umpirsky can you please remove the package.json from this repository? CVE scanners will always report error when someone tries to install this repo as npm package even when they use this repo directly instead of npm.

[yariksheptykin]

See: anchore/grype#3279

[umpirsky]

We can remove package.json, but as you stated, it is a grype issue, isn't it? Can't we just wait for them to fix it?

[yariksheptykin]

@umpirsky I think it's both. We can wait for grype to stop scanning composer packages for package.json. But if someone tries to install this packages via npm stright from this repositiry, grype and any other tool will warn about malware. The name umpirsky/country-list is now tainted in npm-context. It will be related to the malware.

I see two options:

• You only distribute this package as composer package and drop NMP
• You keep package.json and the try to reclame umpirsky namespace in npm and release a new version (package.json is still 1.0.0) of the npm package, which is malware free, so the scanners can relax.

The second option seems the correct one, but it means more work and might be a waste of time if no-one actually installs this with npm. It is likely impossible to tell if there are any users cloning this repo with npm. npm reports some "downloads" per month for the malware package, but those are not many, and they are obviously not actually using the functionality because the sanitized npm package contains only a README file as far as I can see.

Trying to reclame umpirsky on npm is a good idea regardless of your decision with this particular package. This would make similar attacks against your other repos harder.

[umpirsky]

Yeah, I think we will drop NPM. Thanks.

[yariksheptykin]