{"id":"MAL-2025-3128","summary":"Malicious code in @fraudprevention/device-intelligence (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (4499ba2c16cf02f2e12c45bba95e21bd588726f331f7a7a7f8eecfbb0369cafc)\nThe OpenSSF Package Analysis project identified '@fraudprevention/device-intelligence' @ 100.99.100 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-08-18T06:10:43Z","published":"2025-04-04T00:55:52Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-04-04T01:33:46.808803035Z","modified_time":"2025-04-04T00:55:52Z","sha256":"4499ba2c16cf02f2e12c45bba95e21bd588726f331f7a7a7f8eecfbb0369cafc","source":"ossf-package-analysis","versions":["100.99.100"]},{"modified_time":"2025-04-04T01:35:52Z","sha256":"86302a07dfef55764323ffb71c58ea60264a885d9ad3f359863fa24606412c1e","source":"ossf-package-analysis","versions":["20.0.1"],"import_time":"2025-04-04T02:31:57.048550733Z"},{"import_time":"2025-08-18T06:09:46.157581627Z","modified_time":"2025-08-14T22:59:54Z","sha256":"38b2d2961c393171eed9514bfc746ff58fff2d931be69154be68a87ed7dce42f","source":"ossf-package-analysis","versions":["9.8.4"]},{"modified_time":"2025-08-14T22:57:51Z","sha256":"4a99c0b0726c361956400d5df06716afd6868080bf2daafef7c31601ca75e895","source":"ossf-package-analysis","versions":["9.8.3"],"import_time":"2025-08-18T06:09:46.073160572Z"},{"versions":["10.0.0"],"import_time":"2025-08-18T06:09:45.466670236Z","modified_time":"2025-08-13T23:45:45Z","sha256":"58dbe96bcd508b2e0abdd6b1d113f47c3597e2014e6c08c6a76a92afb2266c99","source":"ossf-package-analysis"}]},"affected":[{"package":{"name":"@fraudprevention/device-intelligence","ecosystem":"npm","purl":"pkg:npm/%40fraudprevention/device-intelligence"},"versions":["100.99.100","20.0.1","9.8.4","9.8.3","10.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fraudprevention/device-intelligence/MAL-2025-3128.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}