{"id":"MAL-2025-42051","summary":"Malicious code in paper-dropdown-input (npm)","details":"The package communicates with a domain associated with malicious activity.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (2f60c41c2f87fe82386507e3f611946e4d7b12f970168662d0532b831a12d254)\nThe OpenSSF Package Analysis project identified 'paper-dropdown-input' @ 99.9.3 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2025-09-01T09:08:04Z","published":"2025-08-27T17:27:52Z","database_specific":{"malicious-packages-origins":[{"versions":["99.9.3"],"import_time":"2025-09-01T09:07:33.345885096Z","modified_time":"2025-08-30T08:22:42Z","sha256":"2f60c41c2f87fe82386507e3f611946e4d7b12f970168662d0532b831a12d254","source":"ossf-package-analysis"},{"import_time":"2025-09-01T09:07:32.838832565Z","modified_time":"2025-08-27T17:27:52Z","sha256":"45c5cae08d1d5ee52891ebec91c2d25fb00e902fe4dc8e8e9a4015a0035ad587","source":"ossf-package-analysis","versions":["99.9.1"]},{"import_time":"2025-09-01T09:07:33.602530542Z","modified_time":"2025-08-30T08:37:05Z","sha256":"8acded9113cd171596046ba69c553f5248aa7dfb4bed128539f875588e83ef38","source":"ossf-package-analysis","versions":["99.9.4"]},{"import_time":"2025-09-01T09:07:33.670128751Z","modified_time":"2025-08-30T08:39:52Z","sha256":"c7be47004cdc43cbdf5d7caca170dd5c0dcc68580f559f221b0aaf84956a5a26","source":"ossf-package-analysis","versions":["99.9.5"]}]},"affected":[{"package":{"name":"paper-dropdown-input","ecosystem":"npm","purl":"pkg:npm/paper-dropdown-input"},"ranges":[{"type":"SEMVER","events":[{"introduced":"99.9.1"}]}],"versions":["99.9.3","99.9.1","99.9.4","99.9.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/paper-dropdown-input/MAL-2025-42051.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}