# Malicious npm release

Malicious npm release
Critical · Needs action
Affected: example-package 2.4.1
Fixed in: 2.4.2

A compromised package release may expose environment variables during installation.

What to do:
- Check installed versions.
- Upgrade to 2.4.2.
- Rotate exposed credentials.

Sources:
- Maintainer advisory https://example.com/npm-advisory
- Release notes https://example.com/npm-release

Canonical page: https://www.incidentping.com/incidents/npm-malicious-release