{"id":"MAL-2024-10314","summary":"Malicious code in @toloka-tb/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (c655dc69b310808896f252e5607b9dd8c4bd54b9d139caa655f5816f2269abd4)\nThe OpenSSF Package Analysis project identified '@toloka-tb/core' @ 2.5.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2024-11-03T16:37:34Z","published":"2024-11-03T14:24:47Z","database_specific":{"malicious-packages-origins":[{"import_time":"2024-11-03T14:35:32.590795346Z","modified_time":"2024-11-03T14:24:47Z","sha256":"c655dc69b310808896f252e5607b9dd8c4bd54b9d139caa655f5816f2269abd4","source":"ossf-package-analysis","versions":["2.5.0"]},{"versions":["2.5.1"],"import_time":"2024-11-03T16:37:04.970828808Z","modified_time":"2024-11-03T16:08:57Z","sha256":"a7c72b8c062a3f947979ca8d55e5566100afb0afe5240df513a969e6429a4f70","source":"ossf-package-analysis"}]},"affected":[{"package":{"name":"@toloka-tb/core","ecosystem":"npm","purl":"pkg:npm/%40toloka-tb/core"},"versions":["2.5.0","2.5.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@toloka-tb/core/MAL-2024-10314.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}