Version 6.2.1 of ansi-regex was compromised; other versions are not flagged as malicious. CyberXYZ Proxy blocks the affected versions. It also has 1 known vulnerability, the worst rated HIGH.
Compromised releases. Added to CyberXYZ 2025-09-08, OSV malicious-package feed (Google / OpenSSF).
The package was compromised and malicious code added. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Reported by GitHub Advisory Database via OSV.
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
npm install ansi-regex@6.6.0
0 direct dependencies
none carry a known advisory
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
CVSS v3.1 base score out of 10
chance of exploitation in 30 days, 89th percentile of all CVEs
CyberXYZ composite out of 10
fig. 01 — GHSA-93q8-gq69-wqmw, the advisory selected below
ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.
Full advisory text at GitHub advisory or NVD.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version 6.2.1 of ansi-regex was compromised. Other versions are not flagged as malicious.
Yes. CyberXYZ records 1 known vulnerability for ansi-regex (npm), the worst rated HIGH. They are GHSA-93q8-gq69-wqmw.
Use 6.6.0 or a later release that is not named as malicious. Versions named on this report as malicious must not be installed.
Search ansi-regex in CyberXYZ Check at https://cyberxyz.io/check?q=ansi-regex. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 12:04 UTC. The most recent advisory here was published 2021-09-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.