{"id":"MAL-2024-7899","summary":"Malicious code in @taxify/smartpickups (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (9d20e7ecf4639b1082be1a46fec756d84cc7d8fc35310af0e6af87e19879fcf7)\nThe OpenSSF Package Analysis project identified '@taxify/smartpickups' @ 9.999.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2024-10-24T01:01:55Z","published":"2024-08-06T15:19:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2024-08-06T15:34:13.028826112Z","modified_time":"2024-08-06T15:19:04Z","sha256":"9d20e7ecf4639b1082be1a46fec756d84cc7d8fc35310af0e6af87e19879fcf7","source":"ossf-package-analysis","versions":["9.999.0"]},{"import_time":"2024-08-06T16:36:38.499682032Z","modified_time":"2024-08-06T16:07:02Z","sha256":"5fa6420ceb51b8ece3751b9fa9064288fcf5dce1c0e03513afef21f0de192176","source":"ossf-package-analysis","versions":["10.0.0"]},{"source":"reversing-labs","versions":["8.999.0","9.999.0","10.0.0","10.0.1"],"id":"RLMA-2024-06053","import_time":"2024-10-24T00:56:08.504666521Z","modified_time":"2024-10-16T12:25:31Z","sha256":"49a6b590f70d6795c4456775b23ab6cf5465c929aee73821ed2f9d42ad522df4"}]},"affected":[{"package":{"name":"@taxify/smartpickups","ecosystem":"npm","purl":"pkg:npm/%40taxify/smartpickups"},"versions":["9.999.0","10.0.0","8.999.0","10.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@taxify/smartpickups/MAL-2024-7899.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}