{"id":"MAL-2023-8541","summary":"Malicious code in discord.js-song (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (90ad9bfacffe2ec987335c33f6ec3024291b2cc98ae356cbc0f16a4051ec79b9)\nThe OpenSSF Package Analysis project identified 'discord.js-song' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2023-11-20T23:33:54Z","published":"2023-11-20T21:05:51Z","database_specific":{"malicious-packages-origins":[{"import_time":"2023-11-20T23:33:35.270125631Z","modified_time":"2023-11-20T21:14:38Z","sha256":"90ad9bfacffe2ec987335c33f6ec3024291b2cc98ae356cbc0f16a4051ec79b9","source":"ossf-package-analysis","versions":["1.0.2"]},{"import_time":"2023-11-20T23:33:35.230090573Z","modified_time":"2023-11-20T21:05:51Z","sha256":"a2e6a85c6d3efd6627e9c81756c90b1fc5bd7169b358dfda47fcfb683b530c89","source":"ossf-package-analysis","versions":["1.0.1"]}]},"affected":[{"package":{"name":"discord.js-song","ecosystem":"npm","purl":"pkg:npm/discord.js-song"},"versions":["1.0.2","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord.js-song/MAL-2023-8541.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}