Malware in @opensearch-project/opensearch

Description

The OpenSearch Project has sustained a security incident involving an external actor gaining force-push permissions within the project’s CI infrastructure to embed malicious packages into four release versions of @opensearch-project/opensearch.

Recommendation

No fix is available yet. Followings are affected versions:

• **= 3.8.0

  = 3.7.0

  = 3.6.2

  = 3.5.3**

References

• GHSA-27f5-xjrr-q9ff
• CWE-506

Related Issues

• Malicious Package in coffee-project - Vulnerability
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations - CVE-2026-47717
• Incorrect default cookie name and recommendation - Vulnerability

You might also like:

10 Secure Coding Best Practices to Follow in Every Project

How to Secure your NodeJs Express Javascript Application - part 2

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

@opensearch-project/opensearch