Malicious code in img-to-native (npm)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

MAL-2026-17216

GHSA-pv7p-ghgv-268x

osv · MAL-2026-17216

• https://github.com/advisories/GHSA-pv7p-ghgv-268x
• https://www.npmjs.com/package/img-to-native/v/1.0.0
• https://www.npmjs.com/package/img-to-native/v/1.0.1
• https://www.npmjs.com/package/img-to-native/v/1.0.3
• https://www.npmjs.com/package/img-to-native/v/1.0.2

No related operational record is retained in the current change model.