{"id":"MAL-2025-190611","summary":"Malicious code in hilton-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f865ea8e9dc8af2f134e9b7fc318eceef8ff54af8fc491d1feb2d2c5788441f4)\nThe package hilton-ui was found to contain malicious code.\n\n## Source: ossf-package-analysis (4d969be614230f9c1d44f208827c3946e62c7bee513186925c4ece9ad620e094)\nThe OpenSSF Package Analysis project identified 'hilton-ui' @ 296.8.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2025-11-24T16:09:29Z","published":"2025-11-22T12:46:07Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["296.8.0"],"import_time":"2025-11-22T12:47:10.648957045Z","modified_time":"2025-11-22T12:46:07Z","sha256":"4d969be614230f9c1d44f208827c3946e62c7bee513186925c4ece9ad620e094"},{"import_time":"2025-11-24T16:07:35.319601009Z","modified_time":"2025-11-24T15:54:02Z","sha256":"f865ea8e9dc8af2f134e9b7fc318eceef8ff54af8fc491d1feb2d2c5788441f4","source":"amazon-inspector","versions":["296.8.0"]}]},"affected":[{"package":{"name":"hilton-ui","ecosystem":"npm","purl":"pkg:npm/hilton-ui"},"versions":["296.8.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hilton-ui/MAL-2025-190611.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}