{"id":"MAL-2026-18192","url":"https://compromised.live/t/MAL-2026-18192","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in agentic-awesome-skills (npm)","summary":"Attackers compromised this npm package and inserted malicious code, which can run on a developer's machine when the package is installed or used. npm package agentic-awesome-skills, including versions 18.9.0 through 19.9.0 and other listed releases. Remove the affected agentic-awesome-skills versions now, switch to a known clean release, and check for signs of compromise such as unexpected processes, new scripts, or credential theft.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"agentic-awesome-skills","affected":"19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.13.0, 19.0.1, 18.10.0, 19.2.0, 19.7.0, 19.1.0, 19.3.0, 19.5.0, 19.12.1, 19.13.0, 19.12.0, 18.15.0, 19.8.0, 19.11.0, 19.14.0, 19.15.0","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-03T22:10:45.281Z","status":"active","details":"","aliases":["GHSA-rgwm-3jj9-h563","MAL-2026-18192"],"sources":[{"name":"osv","id":"MAL-2026-18192","url":"https://osv.dev/vulnerability/MAL-2026-18192"}]}