Affected packages
- nitroping
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/advisories/GHSA-472x-2fx6-8gwx
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
- https://www.npmjs.com/package/nitroping/v/0.2.4
- https://www.npmjs.com/package/nitroping/v/0.2.11
- https://www.npmjs.com/package/nitroping/v/0.2.12
- https://www.npmjs.com/package/nitroping/v/0.2.9
- https://www.npmjs.com/package/nitroping/v/0.2.6
- https://www.npmjs.com/package/nitroping/v/0.2.3
- https://www.npmjs.com/package/nitroping/v/0.2.8
- https://www.npmjs.com/package/nitroping/v/0.2.13
- https://www.npmjs.com/package/nitroping/v/0.2.10
- https://www.npmjs.com/package/nitroping/v/0.2.5
- https://www.npmjs.com/package/nitroping/v/0.2.7
- https://www.npmjs.com/package/nitroping/v/0.2.14
Structured record: https://osv.dev/vulnerability/MAL-2025-191134
Recommended response stack
Snyk — Scan your dependencies in CI and fix this vulnerability.→Socket — Detect malicious and compromised packages before they ship.→
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta