{"id":"MAL-2023-1489","summary":"Malicious code in marvelmaniac-devvit-rce (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f)\nThe OpenSSF Package Analysis project identified 'marvelmaniac-devvit-rce' @ 1.0.3 (npm) as malicious.\n\nIt is considered malicious because:\n- The package communicates with a domain associated with malicious activity.\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2023-08-21T04:11:13Z","published":"2023-08-19T08:24:25Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["1.0.3"],"import_time":"2023-08-19T09:05:07.693694383Z","modified_time":"2023-08-19T08:57:26.848267963Z","sha256":"db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f"},{"import_time":"2023-08-19T09:05:07.526340658Z","modified_time":"2023-08-19T08:44:35.306473645Z","sha256":"ea60eb57d4b93e4cb6a2b9e6da809e7f13c798da70b5acce64b1b1d68201dfe0","source":"ossf-package-analysis","versions":["1.0.2"]},{"modified_time":"2023-08-19T08:37:59.9956313Z","sha256":"3bc5c79cf655b35608bc3a69ef83b3822b42982ea5a4b01d2576d42dc184a5e3","source":"ossf-package-analysis","versions":["1.0.1"],"import_time":"2023-08-21T04:06:03.37145166Z"},{"import_time":"2023-08-21T04:06:03.268552832Z","modified_time":"2023-08-19T08:24:25.490128804Z","sha256":"58c1c248c6d2ebf72dd43aa540e8b0fc6e01d6034a9d7053d13bf177a920c608","source":"ossf-package-analysis","versions":["1.0.0"]}]},"affected":[{"package":{"name":"marvelmaniac-devvit-rce","ecosystem":"npm","purl":"pkg:npm/marvelmaniac-devvit-rce"},"versions":["1.0.3","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/marvelmaniac-devvit-rce/MAL-2023-1489.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}