{"id":"MAL-2025-192812","summary":"Malicious code in jsonrecap (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a7e3ea65451f642ffd038933f2ca3b5dab39d6ee6979b4783353af6250dc22e9)\nThe package jsonrecap was found to contain malicious code.\n","aliases":["SNYK-JS-JSONRECAP-14152271"],"modified":"2026-03-19T12:45:17.883188Z","published":"2025-12-23T08:18:00Z","database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","versions":["3.1.8"],"id":"RLMA-2025-06378","import_time":"2025-12-24T10:07:23.973509286Z","modified_time":"2025-12-23T08:18:00Z","sha256":"0f2988a1bf0dbfd6ff12cb50f4278ad710593f273f8e6e8b594f6d95081ca1aa"},{"import_time":"2026-01-02T21:35:52.811798026Z","modified_time":"2026-01-02T21:29:26Z","sha256":"a7e3ea65451f642ffd038933f2ca3b5dab39d6ee6979b4783353af6250dc22e9","source":"amazon-inspector","versions":["3.1.8"]},{"import_time":"2026-03-19T12:20:55.441552276Z","modified_time":"2026-03-18T12:56:10Z","sha256":"a41d1fcb63a586513d9cca8b1183243004470500c8db731516479b0a771a3dbb","source":"reversing-labs","id":"RLUA-2026-01378"}]},"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-JSONRECAP-14152271"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"affected":[{"package":{"name":"jsonrecap","ecosystem":"npm","purl":"pkg:npm/jsonrecap"},"versions":["3.1.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jsonrecap/MAL-2025-192812.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}