The OpenSearch Project's npm publishing infrastructure was compromised, leading to the publication of inauthentic OpenSearch prerelease artifacts containing malicious packages. The affected versions were identified and removed from the npm repository.
| Vendor | Product | Versions |
|---|---|---|
| opensearch project | — | 3.5.3, 3.6.2, 3.7.0, 3.8.0 |
