{"id":"MAL-2025-190600","summary":"Malicious code in optly (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e0772e230f188de88a82becfa6493f2c39c36e63290339595308366a84154a56)\nThe package optly was found to contain malicious code.\n\n## Source: ossf-package-analysis (e70192025ea0e8c030d0adbe15f6c3272271f3b25cb13eedfb8136da48c9a29a)\nThe OpenSSF Package Analysis project identified 'optly' @ 90.6.6 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-11-24T16:09:31Z","published":"2025-11-21T10:10:55Z","database_specific":{"malicious-packages-origins":[{"versions":["90.6.6"],"import_time":"2025-11-21T10:39:10.361745299Z","modified_time":"2025-11-21T10:10:55Z","sha256":"e70192025ea0e8c030d0adbe15f6c3272271f3b25cb13eedfb8136da48c9a29a","source":"ossf-package-analysis"},{"modified_time":"2025-11-24T15:39:21Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"sha256":"e0772e230f188de88a82becfa6493f2c39c36e63290339595308366a84154a56","source":"amazon-inspector","import_time":"2025-11-24T16:07:33.095867836Z"}]},"affected":[{"package":{"name":"optly","ecosystem":"npm","purl":"pkg:npm/optly"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["90.6.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/optly/MAL-2025-190600.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}