{"id":"MAL-2024-1847","summary":"Malicious code in business-kpi-manager (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (d40c2ea693da70760733dd3ec3fd7dd594c8c49c6e937ec9699b9ec831cc960e)\nThe OpenSSF Package Analysis project identified 'business-kpi-manager' @ 4.0.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-05-22T14:07:46Z","published":"2024-06-25T12:30:21Z","database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","versions":["2.3.0"],"id":"RLMA-2024-00444","import_time":"2024-06-28T02:42:06.588242233Z","modified_time":"2024-06-25T12:30:21Z","sha256":"e50c66f5aaba8c1ccfaa2e82e033a82da11c8bccb21c583203e5c2e3c1d563c0"},{"source":"reversing-labs","id":"RLUA-2024-06256","import_time":"2024-10-24T00:57:36.462467618Z","modified_time":"2024-10-16T12:36:17Z","sha256":"5d8551cbf195f119da5bf7e861b67f56fa56492ebdb3b2f25435d985e035c49e"},{"sha256":"d40c2ea693da70760733dd3ec3fd7dd594c8c49c6e937ec9699b9ec831cc960e","source":"ossf-package-analysis","versions":["4.0.4"],"import_time":"2025-01-22T09:34:36.852550218Z","modified_time":"2025-01-21T16:45:49Z"},{"import_time":"2025-01-22T21:05:25.730960635Z","modified_time":"2025-01-22T14:35:59Z","sha256":"d54e40d9b69a1bb13fcba5c852d84ea8c8ad46d3390ac2976093e9d64b681c0c","source":"ossf-package-analysis","versions":["4.0.5"]},{"id":"RLUA-2025-00684","import_time":"2025-03-03T15:07:23.807344218Z","modified_time":"2025-03-03T13:20:43Z","sha256":"b18564286d2f85a6383f16bb8fb855da5b7674eb0053cd8ff39b2e26dd2488ff","source":"reversing-labs","versions":["4.0.7","4.0.3","4.0.5","4.0.1","4.0.4","4.0.0"]},{"id":"RLUA-2025-02709","import_time":"2025-05-22T14:07:12.22950696Z","modified_time":"2025-05-22T12:41:32Z","sha256":"f7546d2008465fc03968e26c8b97c4ccb3df38b2525181d379d37a30c8041bcc","source":"reversing-labs","versions":["4.0.6"]}]},"affected":[{"package":{"name":"business-kpi-manager","ecosystem":"npm","purl":"pkg:npm/business-kpi-manager"},"versions":["2.3.0","4.0.4","4.0.5","4.0.7","4.0.3","4.0.1","4.0.0","4.0.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/business-kpi-manager/MAL-2024-1847.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}