{"id":"MAL-2023-8125","summary":"Malicious code in pmd-github-action (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (25570da8772dbadd784a50cef765f49e039bdd693711fa519447931729c5ec72)\nThe OpenSSF Package Analysis project identified 'pmd-github-action' @ 7.2.9 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2023-09-19T04:35:01Z","published":"2023-09-18T16:36:57Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2023-09-18T17:18:10Z","sha256":"25570da8772dbadd784a50cef765f49e039bdd693711fa519447931729c5ec72","source":"ossf-package-analysis","versions":["7.2.9"],"import_time":"2023-09-18T17:34:23.022536945Z"},{"modified_time":"2023-09-18T17:10:45Z","sha256":"a1f0ddffd09c742a9fb1800552d1d62c789596cc1be17ddcece869a2e3dafefc","source":"ossf-package-analysis","versions":["7.9.9"],"import_time":"2023-09-18T17:34:22.958039742Z"},{"import_time":"2023-09-19T04:34:40.893009725Z","modified_time":"2023-09-18T16:50:37Z","sha256":"40cfc6449425b40cb1843150153cd37cfb95b7369f18b98ba4f71bb6c19a4f17","source":"ossf-package-analysis","versions":["9.9.9"]},{"modified_time":"2023-09-18T16:36:57Z","sha256":"848b98ef9e3b341f70eb8accf2bd526095d488e08fb67886aa5aa29504d5da6f","source":"ossf-package-analysis","versions":["2.1.1"],"import_time":"2023-09-19T04:34:40.784565762Z"}]},"affected":[{"package":{"name":"pmd-github-action","ecosystem":"npm","purl":"pkg:npm/pmd-github-action"},"versions":["7.2.9","7.9.9","9.9.9","2.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pmd-github-action/MAL-2023-8125.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}