Malware in size-sensor Affected Versions >= 0 Is Blocking

[kyla-glitch]

No versions of size-sensor is allowed

[kyla-glitch]

versions 1.2.4, 1.1.4 and 1.0.4 are affected
hustcc/size-sensor#27

[samigt]

Findings:

• The GitHub advisory (GHSA-gx6x-v325-85g4) states "all versions" are affected, but this is overstated
• The actual compromise only affected v1.0.4 and later versions
• v1.0.3 is the last legitimate release (Jan 16, 2026) in the official GitHub repository
• Malicious versions (v1.0.4, v1.2.4, etc.) were published directly to npm only, bypassing GitHub entirely
• The npm account compromise was discovered and addressed on May 19, 2026 (GitHub issue Advisory improvement for GHSA-fmvm-x8mv-47mj #27)

Evidence:

• GitHub repository only contains 4 official releases: v1.0.0 through v1.0.3
• No commits or tags exist for v1.0.4 or higher in the repository
• Last legitimate commit: Jan 24, 2026 (Node.js compatibility fix)

Correct ?

[shelbyc]

The vulnerable version range has been corrected. Thanks for the issue!

[rhdesmond]

Is there a link to the PR fix? I see in the ossf repository it still says the range is (min, max): https://github.com/ossf/malicious-packages/blame/main/osv/malicious/npm/size-sensor/MAL-2026-4153.json

Is there another canonical data source ghsa db uses for malicious packages? I do not see the GHSA advisory in the advisory-database repository