Screenshot of socket.dev report has the following alert: Known malware: This package is malware. We have asked the package registry to remove it. Found 1 instance in 1 package

Notices where this attachment appears

1. Embed this notice
   Zach Leatherman :11ty: (zachleat@fediverse.zachleat.com)'s status on Tuesday, 25-Mar-2025 12:24:28 JST Zach Leatherman :11ty:

   Why does socket.dev report that the latest version of next.js has a malware dependency? https://socket.dev/npm/package/next/alerts/15.2.3?tab=dependencies

   “Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

   Update: looks like this is a pretty big flaw in the vulnerability scanner — not in next (check the replies for more info)