{"id":"MAL-2024-11932","summary":"Malicious code in bs-auto-dark-mode (npm)","details":"This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (8a5c6958e14a49e20ebdd6902cdb4cad7872983ed4d39e94b625cc50a20314ac)\nThe OpenSSF Package Analysis project identified 'bs-auto-dark-mode' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-01-02T08:24:48Z","published":"2024-12-18T07:38:28Z","database_specific":{"malicious-packages-origins":[{"import_time":"2024-12-20T00:21:37.449579061Z","modified_time":"2024-12-18T07:38:28Z","sha256":"8a5c6958e14a49e20ebdd6902cdb4cad7872983ed4d39e94b625cc50a20314ac","source":"ossf-package-analysis","versions":["1.0.0"]},{"source":"ossf-package-analysis","versions":["1.0.2"],"import_time":"2024-12-20T00:49:25.386844751Z","modified_time":"2024-12-18T10:18:02Z","sha256":"aab655718f2f8de50ede2933bf00064291d0e9286bf225ffd2027b3dfe30d335"}]},"affected":[{"package":{"name":"bs-auto-dark-mode","ecosystem":"npm","purl":"pkg:npm/bs-auto-dark-mode"},"versions":["1.0.0","1.0.2","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs-auto-dark-mode/MAL-2024-11932.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"Stacklok Insight: insight.stacklok.com","contact":["https://discord.com/invite/RkzVuTp3WK"],"type":"FINDER"}]}