Write what the file is claimed to carry

Write only what the page says

The page's claim is: GitHub published 19 malware advisories between 2026-10-25T09:35:17Z and 2026-10-25T09:35:19Z for npm: cert-infos all versions (>= 0); p12-pem all versions (>= 0); ionic-insta-api-wrapper all versions (>= 0); youtube-info-streams all versions (>= 0); appit-cordova-admob all versions (>= 0); ionic-insta-search all versions (>= 0); cordova-plugin-geofence-appit all versions (>= 0); appit-cordova-plugin-ionic all versions (>= 0); redis-dumper all versions (>= 0); ocsp-hashes all versions (>= 0); ionic-youtube-streams all versions (>= 0); ionic-youtube-search all versions (>= 0); youtube-search-without-api-key all versions (>= 0); insta-api-wrapper all versions (>= 0); sound-cloud-loader-api all versions (>= 0); ionic-sound-cloud-loader-api all versions (>= 0); ionic-tiktok-scraper all versions (>= 0); insta-reel-search all versions (>= 0); tiktok-video-scraper all versions (>= 0). GitHub published malware advisories for these packages at 09:35Z with all versions (>= 0) affected. GitHub says any computer that has one installed or running should be considered fully compromised. No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T09:35:17Z / Security record: GHSA-8mjx-r4j6-3h6g, GHSA-74xg-w33f-jpv3, GHSA-65qr-q8w8-4q7r, GHSA-7mfw-r26v-9r9f, GHSA-9w8h-674f-4x2j, GHSA-4fw4-xm5r-mh69, GHSA-5pw8-3xv5-6cmg, GHSA-fr38-45mf-vcqf, GHSA-8gg8-xq45-8fx5, GHSA-9v69-fx5h-r6p6, GHSA-3cc7-77mx-rmj6, GHSA-7p9r-26fp-m47g, GHSA-f6m2-r9qr-44fx, GHSA-j8vh-32vh-rj39, GHSA-5f99-52fc-5rc9, GHSA-g89m-8c48-9x73, GHSA-wwj3-4v8w-w98j, GHSA-v2r2-x76j-6fcx, GHSA-5xjv-xr86-9hrv / Fixed release: none yet / Discovery confidence: High

Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.

Separate the object from the proof. A sender's sentence is not a completed check.

Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.

A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.

Stop at the untested line

Anything you did not open, install, or count stays untested. Leave that line visible.

Source page: Batch of 19 npm packages flagged as malware by GitHub (ionic, social-media scraper, cordova and certificate helper packages) (GitHub malware advisories GHSA-8mjx-r4j6-3h6g and 18 more).

Sources: Batch of 19 npm packages flagged as malware by GitHub (ionic, social-media scraper, cordova and certificate helper packages) (GitHub malware advisories GHSA-8mjx-r4j6-3h6g and 18 more)

Related guides

• Write what the file is claimed to carry
• Write what the file is claimed to carry
• Write what the file is claimed to carry

Primary references

• Batch of 19 npm packages flagged as malware by GitHub (ionic, social-media scraper, cordova and certificate helper packages) (GitHub malware advisories GHSA-8mjx-r4j6-3h6g and 18 more)