discovered
@needl-ai/common is identified in the SafeDep analysis "Malicious npm Dependency Confusion Campaign Targets Genoma UI and Others". A dependency confusion campaign by npm user victim59 targets at least three organizations through scoped packages @genoma-ui/components, @needl-ai/common, and rrweb-v1. The packages use install hooks to beacon system reconnaissance data to a DigitalOcean C2 server.