npm package report

Is @emilgroup/notification-sdk-node safe?

Versions 1.4.2 and 1.4.1 of @emilgroup/notification-sdk-node were compromised (credential stealer). Other versions are not flagged as malicious.

Do not install @emilgroup/notification-sdk-node 1.4.2 or 1.4.1

CRITICAL

Credential stealer. Added to CyberXYZ 2026-03-22, OSV malicious-package feed (Google / OpenSSF).

// what we observed

file identical to known malware+70
dist/api.js is byte-identical to known malware (sha256 89fa2d5936c7e94cd37e5a438e1ff39fe096a48339301184f39c84db0b3c5550 = confirmed_scan:@emilgroup/notification-sdk-node@1.10.1-beta.13(@emilgroup/notification)
package contents+8
source finding (sev 10)
package contents+15
novel source finding (sev 9)

Reported by Amazon Inspector, GitHub Advisory Database and Google Open Source Security via OSV.

mitre ttp: T1056

// versions and what to do

Malicious: 1.4.2, 1.4.1
Move to: 1.10.0 newest 1.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @emilgroup/notification-sdk-node@1.10.0

OSV record

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:00 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.