A name on the page is not a finished check

Write only what the page says

The page's claim is: GitHub published 2 malware advisories between 2026-10-25T15:31:35Z and 2026-10-25T15:31:35Z for npm: @drone-js-ext/vip-badge 99.0.1; @drone-js-ext/core 99.0.1. Per the GitHub advisories (source: amazon-inspector), these are zero-functionality stubs with a beacon.cjs that collects host identifiers (hostname, install path, working directory, Node version) and sends them out. No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T15:31:35Z / Security record: GHSA-g6h7-w896-4p29, GHSA-68q8-r62c-rwgx / Fixed release: none yet / Discovery confidence: High

Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.

One row per name. Leave the result cell empty until you have an action you could fail.

Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.

A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.

Stop at the untested line

Anything you did not open, install, or count stays untested. Leave that line visible.

Source page: Malicious npm packages in the @drone-js-ext scope (99.0.1) (GitHub malware advisories GHSA-g6h7-w896-4p29, GHSA-68q8-r62c-rwgx).

Sources: Malicious npm packages in the @drone-js-ext scope (99.0.1) (GitHub malware advisories GHSA-g6h7-w896-4p29, GHSA-68q8-r62c-rwgx)

Related guides

• A name on the page is not a finished check
• A name on the page is not a finished check
• A name on the page is not a finished check

Primary references

• Malicious npm packages in the @drone-js-ext scope (99.0.1) (GitHub malware advisories GHSA-g6h7-w896-4p29, GHSA-68q8-r62c-rwgx)