{"id":"MAL-2025-44063","summary":"Malicious code in dotevn (npm)","details":"The package dotevn was found to contain malicious code.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n","aliases":["SNYK-JS-DOTEVN-13561253"],"modified":"2025-12-02T10:14:45.762172Z","published":"2025-09-05T16:38:20Z","database_specific":{"malicious-packages-origins":[{"id":"RLMA-2025-04989","import_time":"2025-09-26T11:05:50.877165511Z","modified_time":"2025-09-26T09:29:08Z","sha256":"efa0c2d8cfbc42b24a9912b6c0df7a6eb6a5b2774a18b194e47679c84821eef7","source":"reversing-labs","versions":["17.2.1"]},{"modified_time":"2025-12-01T13:08:55Z","sha256":"738480b98885c0854f054d3aec0d950ac5b6a291556a3b29ed2215467f14a2c4","source":"reversing-labs","id":"RLUA-2025-05769","import_time":"2025-12-02T09:10:03.308315066Z"}]},"references":[{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-DOTEVN-13561253"},{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages"}],"affected":[{"package":{"name":"dotevn","ecosystem":"npm","purl":"pkg:npm/dotevn"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["17.2.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dotevn/MAL-2025-44063.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}