{"id":"MAL-2025-192952","summary":"Malicious code in eslint-config-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e71714baca3a4619a8482f00c00fbed0efcca855796a70e740d4f53a3f807003)\nThe package eslint-config-sdk was found to contain malicious code.\n\n## Source: ossf-package-analysis (f555787a619d1fb5f878d4d2bc13ec29597ef72d472ef1c2897a92de23ec1662)\nThe OpenSSF Package Analysis project identified 'eslint-config-sdk' @ 101.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-03-19T12:44:04.186149Z","published":"2025-12-27T20:20:29Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2025-12-27T20:20:29Z","sha256":"f555787a619d1fb5f878d4d2bc13ec29597ef72d472ef1c2897a92de23ec1662","source":"ossf-package-analysis","versions":["101.0.1"],"import_time":"2025-12-27T20:37:59.702239224Z"},{"source":"ossf-package-analysis","versions":["101.0.4"],"import_time":"2025-12-28T17:37:24.323029539Z","modified_time":"2025-12-28T17:25:34Z","sha256":"957e494a4b9c9985c6f16f935729cea70631deadb9f0e96f5b1dfa6675dc31bb"},{"modified_time":"2026-01-02T21:29:26Z","sha256":"e71714baca3a4619a8482f00c00fbed0efcca855796a70e740d4f53a3f807003","source":"amazon-inspector","versions":["101.0.1","101.0.4"],"import_time":"2026-01-02T21:35:49.047194821Z"},{"sha256":"394c5581f84c76ebac0325559f81088ed9f64d89d59c08d74ac47b4005bd3ff9","source":"reversing-labs","versions":["1.0.0","1.0.1","1.1.2","1.1.3","99.0.0","100.0.0","101.0.1","101.0.2","101.0.3","101.0.4"],"id":"RLMA-2026-01296","import_time":"2026-03-19T12:18:49.982022054Z","modified_time":"2026-03-18T12:49:27Z"}]},"affected":[{"package":{"name":"eslint-config-sdk","ecosystem":"npm","purl":"pkg:npm/eslint-config-sdk"},"versions":["101.0.1","101.0.4","1.0.0","1.0.1","1.1.2","1.1.3","99.0.0","100.0.0","101.0.2","101.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-config-sdk/MAL-2025-192952.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}