{"id":"MAL-2024-11814","summary":"Malicious code in @tradm/my_package_legit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (29cce75017efa5cb89df0d22884f39b9d70b835108800ea9b64b10f295f11eb7)\nThe OpenSSF Package Analysis project identified '@tradm/my_package_legit' @ 1.9.24 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2024-12-16T03:21:27Z","published":"2024-12-06T16:05:45Z","database_specific":{"malicious-packages-origins":[{"versions":["1.9.24"],"import_time":"2024-12-13T01:33:30.668638017Z","modified_time":"2024-12-11T12:09:25Z","sha256":"29cce75017efa5cb89df0d22884f39b9d70b835108800ea9b64b10f295f11eb7","source":"ossf-package-analysis"},{"sha256":"72a8a256b7fc0a6a59d3d6e76a1462ab7179db09766657ff34faf1970af26c16","source":"ossf-package-analysis","versions":["1.9.25"],"import_time":"2024-12-13T01:33:30.743051164Z","modified_time":"2024-12-11T12:36:03Z"},{"import_time":"2024-12-13T01:33:30.470012319Z","modified_time":"2024-12-11T10:45:56Z","sha256":"93fc7ac726061953058c6fb04dc727463e6778f5dfd6cfbf4839c49cd5a87a47","source":"ossf-package-analysis","versions":["1.9.20"]},{"import_time":"2024-12-13T01:33:30.841859794Z","modified_time":"2024-12-11T13:45:44Z","sha256":"95a407ed9ea8a1fec7e66a68b6e2826978b86b8d1fb881ce3f3d96e675aeea0a","source":"ossf-package-analysis","versions":["1.9.27"]},{"versions":["1.9.21"],"import_time":"2024-12-13T01:33:30.556843116Z","modified_time":"2024-12-11T10:52:42Z","sha256":"9d68d94a0dc57d72b3fd7a07bbb4a992caded36940ade0fd10c452c554dd22b6","source":"ossf-package-analysis"},{"import_time":"2024-12-16T03:20:58.348279895Z","modified_time":"2024-12-06T16:05:45Z","sha256":"245c700e760b67a98524924c97a682b4e93d27ad3dd695db67ece9ee62b8f44d","source":"ossf-package-analysis","versions":["1.9.0"]},{"sha256":"31efb9cedb32f835f62c26ccfbc3cf03d47599de652468c8c23124735779d516","source":"ossf-package-analysis","versions":["1.9.1"],"import_time":"2024-12-16T03:20:58.50461194Z","modified_time":"2024-12-06T16:13:43Z"},{"import_time":"2024-12-16T03:20:58.759197679Z","modified_time":"2024-12-06T16:20:51Z","sha256":"322600b603307ada9250b3f5c44ad000404b903586a6dfd2ce88f49f60e79ef1","source":"ossf-package-analysis","versions":["1.9.4"]},{"modified_time":"2024-12-06T17:45:44Z","sha256":"40936075da678ab876cbe0d4230edfada0d59eb9700afd8b2429f35000751d0f","source":"ossf-package-analysis","versions":["1.9.18"],"import_time":"2024-12-16T03:20:59.144717936Z"},{"import_time":"2024-12-16T03:20:58.896894906Z","modified_time":"2024-12-06T16:45:51Z","sha256":"7d2d934ad34c50d54538f477f632e18392c566a9060debb580c6c4eed72f46bc","source":"ossf-package-analysis","versions":["1.9.8"]},{"import_time":"2024-12-16T03:20:59.035554845Z","modified_time":"2024-12-06T16:55:51Z","sha256":"956386e1ac2c4f4411498c19ae681b3f7ce6893e1e46483971c166af0e83a000","source":"ossf-package-analysis","versions":["1.9.7"]},{"source":"ossf-package-analysis","versions":["1.9.3"],"import_time":"2024-12-16T03:20:58.635585772Z","modified_time":"2024-12-06T16:16:07Z","sha256":"fcab72676186c44f5d226ae162fe1623d948423d566c10005ea278a3dc872bda"}]},"affected":[{"package":{"name":"@tradm/my_package_legit","ecosystem":"npm","purl":"pkg:npm/%40tradm/my_package_legit"},"versions":["1.9.24","1.9.25","1.9.20","1.9.27","1.9.21","1.9.0","1.9.1","1.9.4","1.9.18","1.9.8","1.9.7","1.9.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@tradm/my_package_legit/MAL-2024-11814.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}