{"id":"MAL-2024-1666","summary":"Malicious code in internal-udfc-pkg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (25708e4f5f0536339a12c9bf28e659c821359f2733ff51d193cd6d74443c3650)\nThe OpenSSF Package Analysis project identified 'internal-udfc-pkg' @ 5.5.5 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2024-06-25T21:05:11Z","published":"2024-06-25T18:36:00Z","database_specific":{"malicious-packages-origins":[{"import_time":"2024-06-25T19:05:21.408518925Z","modified_time":"2024-06-25T18:36:00Z","sha256":"25708e4f5f0536339a12c9bf28e659c821359f2733ff51d193cd6d74443c3650","source":"ossf-package-analysis","versions":["5.5.5"]},{"import_time":"2024-06-25T19:05:21.516360622Z","modified_time":"2024-06-25T18:48:12Z","sha256":"d2cfbcdf083976076ca37b32be3a91cb36b9c5b9c9beb602b6369964904c1bd2","source":"ossf-package-analysis","versions":["5.5.6"]},{"import_time":"2024-06-25T19:33:49.532569063Z","modified_time":"2024-06-25T19:15:48Z","sha256":"e8e8956fbe7f64d6c3879aa7a3030ba1b085299688dc1299834fff9e7801cef8","source":"ossf-package-analysis","versions":["5.5.7"]},{"import_time":"2024-06-25T21:04:51.241443785Z","modified_time":"2024-06-25T20:48:40Z","sha256":"43d2d51866ac43fb5a060de3316792c60a9d7fdfbcd996d2a52265c09cdee30b","source":"ossf-package-analysis","versions":["5.5.8"]},{"import_time":"2024-06-25T21:04:51.180012747Z","modified_time":"2024-06-25T20:44:42Z","sha256":"88838d46d17cc336ce7d54257ef86c0369f24f86d0bb6b1fc84464a62a06e2ed","source":"ossf-package-analysis","versions":["5.5.9"]}]},"affected":[{"package":{"name":"internal-udfc-pkg","ecosystem":"npm","purl":"pkg:npm/internal-udfc-pkg"},"versions":["5.5.5","5.5.6","5.5.7","5.5.8","5.5.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internal-udfc-pkg/MAL-2024-1666.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}