{"id":"MAL-2024-9565","summary":"Malicious code in config-conventional (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (9db287fbaa3f09a3e8e30d18616b161cbc82f46c0867a4f8638067c82846d154)\nThe OpenSSF Package Analysis project identified 'config-conventional' @ 20.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-08-01T10:42:04Z","published":"2024-10-16T12:41:08Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2024-06343","import_time":"2024-10-24T00:56:17.105845825Z","modified_time":"2024-10-16T12:41:08Z","sha256":"5da07c9f7b4b3f7ade17d575798de3eaaf78405f6667073f06652dbc86eafca6","source":"reversing-labs","versions":["213.21.24"]},{"modified_time":"2025-06-29T14:38:54Z","sha256":"9db287fbaa3f09a3e8e30d18616b161cbc82f46c0867a4f8638067c82846d154","source":"ossf-package-analysis","versions":["20.1.1"],"import_time":"2025-06-29T15:04:53.783053181Z"},{"id":"RLUA-2025-03806","import_time":"2025-08-01T10:41:36.377497335Z","modified_time":"2025-07-31T19:26:51Z","sha256":"84ae4232ef681a458ef8f06e4c4f2b14e4a092137af741653dfa463ff519d605","source":"reversing-labs","versions":["20.1.1"]}]},"affected":[{"package":{"name":"config-conventional","ecosystem":"npm","purl":"pkg:npm/config-conventional"},"versions":["213.21.24","20.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/config-conventional/MAL-2024-9565.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}