{"id":"MAL-2025-190500","summary":"Malicious code in com.mixpanel.unity (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a617ed7539b6703818676ef051a6c12331b0e014026d1b56fb7d72775d7ad5a1)\nThe package com.mixpanel.unity was found to contain malicious code.\n\n## Source: ossf-package-analysis (5ec0e0ae867783b60103d188d7eb594338fc023f5dd58f00d3b04d1186eef0c9)\nThe OpenSSF Package Analysis project identified 'com.mixpanel.unity' @ 5.5.3 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-11-17T17:39:44Z","published":"2025-11-16T19:46:57Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-11-16T20:07:00.94151313Z","modified_time":"2025-11-16T19:46:57Z","sha256":"5ec0e0ae867783b60103d188d7eb594338fc023f5dd58f00d3b04d1186eef0c9","source":"ossf-package-analysis","versions":["5.5.3"]},{"modified_time":"2025-11-17T17:14:41Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"a617ed7539b6703818676ef051a6c12331b0e014026d1b56fb7d72775d7ad5a1","source":"amazon-inspector","import_time":"2025-11-17T17:38:13.918525191Z"}]},"affected":[{"package":{"name":"com.mixpanel.unity","ecosystem":"npm","purl":"pkg:npm/com.mixpanel.unity"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["5.5.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.mixpanel.unity/MAL-2025-190500.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}