{"id":"MAL-2023-8160","summary":"Malicious code in bbc-iplayer-sounds-chatbot (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a)\nThe OpenSSF Package Analysis project identified 'bbc-iplayer-sounds-chatbot' @ 5.2.3 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2023-09-19T14:35:01Z","published":"2023-09-19T13:50:43Z","database_specific":{"malicious-packages-origins":[{"import_time":"2023-09-19T14:05:22.201038387Z","modified_time":"2023-09-19T13:55:46Z","sha256":"2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a","source":"ossf-package-analysis","versions":["5.2.3"]},{"sha256":"ea9e5d55fcfc5fd20fe718f031e2ca274f6890f54db23f04d9026ea4386475bc","source":"ossf-package-analysis","versions":["7.2.3"],"import_time":"2023-09-19T14:05:22.042564684Z","modified_time":"2023-09-19T13:50:43Z"},{"import_time":"2023-09-19T14:34:33.47179342Z","modified_time":"2023-09-19T14:14:06Z","sha256":"bc0cead55e9b5f6bb939d5ff6fcdee0880185668373bfb728eb7b565452d02bf","source":"ossf-package-analysis","versions":["1.2.3"]}]},"affected":[{"package":{"name":"bbc-iplayer-sounds-chatbot","ecosystem":"npm","purl":"pkg:npm/bbc-iplayer-sounds-chatbot"},"versions":["5.2.3","7.2.3","1.2.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bbc-iplayer-sounds-chatbot/MAL-2023-8160.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}