This package is flagged as malware in Github Advisory Database.

[mburakeker]

Hi, I just see that this package is reported as malware, any details about this?

https://osv.dev/vulnerability/MAL-2025-47172
GHSA-6wgq-85c7-p729

[mburakeker]

Could this be related to the latest github action runs?

[mburakeker]

After checking the output of that action, it seems that secrets were sent to a website, and you can even see the secrets yourself without even checking the website.

uh @NathanWalker sorry to bear the bad news but I think you got hacked

[mburakeker]

oh-kay I just came across this:
https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

@NathanWalker I think you got affected by this

[NathanWalker]

Should be all clear now, please use this issue to ping if notice anything else suspicious.