{"id":"MAL-2024-7091","summary":"Malicious code in parser-7.0.0 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (99ace32a9b913ac4a00ad574ac934c4eb6274d7c0cf3b948ced6b8191f511b68)\nThe OpenSSF Package Analysis project identified 'parser-7.0.0' @ 4.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2024-07-15T22:05:21Z","published":"2024-07-03T20:10:48Z","database_specific":{"malicious-packages-origins":[{"versions":["4.0.0"],"import_time":"2024-07-03T20:34:00.15621249Z","modified_time":"2024-07-03T20:10:48Z","sha256":"99ace32a9b913ac4a00ad574ac934c4eb6274d7c0cf3b948ced6b8191f511b68","source":"ossf-package-analysis"},{"versions":["4.0.1"],"import_time":"2024-07-03T21:05:40.518666273Z","modified_time":"2024-07-03T20:41:11Z","sha256":"72c851a27c544af5f7efab5fec1c75174007b92d2f3274e2852e1b12fd90bc2f","source":"ossf-package-analysis"},{"import_time":"2024-07-03T23:05:42.515060971Z","modified_time":"2024-07-03T22:54:50Z","sha256":"31a5333925c5a18f4cb586ce86da468937b8953a8c28177aec4cd576bb746faf","source":"ossf-package-analysis","versions":["4.0.2"]},{"import_time":"2024-07-04T00:17:44.359655882Z","modified_time":"2024-07-03T23:40:54Z","sha256":"362e7d5c9bc5ee6f8637073dc42e7e215fe76d1b8e53ac01e67f6d46ce63a188","source":"ossf-package-analysis","versions":["4.0.6"]},{"versions":["4.0.5"],"import_time":"2024-07-15T22:04:53.94588679Z","modified_time":"2024-07-03T23:38:15Z","sha256":"0fb9848c7d524b85f8c67e5278c0eafbd528dae325123fa119fed1b4a3b5adfe","source":"ossf-package-analysis"}]},"affected":[{"package":{"name":"parser-7.0.0","ecosystem":"npm","purl":"pkg:npm/parser-7.0.0"},"versions":["4.0.0","4.0.1","4.0.2","4.0.6","4.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/parser-7.0.0/MAL-2024-7091.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}