npm package report

Is jajajejejiji safe?

This package is in our known-malicious corpus. Details below.

Flagged as malicious

malware, affects all versions

cvss

9.0

how bad it is if exploited, out of 10

epss

not scored

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-rggq-f2wf-m6cp, the advisory selected below

// advisories

GHSA-rggq-f2wf-m6cp

CRITICAL

All versions of jajajejejiji typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.

Affected: >= 0
Fixed in: not stated
Weakness: CWE-506
Published: 2020-09-02
Source: github

GHSA reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 00:54 UTC. The most recent advisory here was published 2020-09-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is jajajejejiji safe? npm package security report | CyberXYZ