{"id":"MAL-2025-47025","summary":"Malicious code in @coveops/abi (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (75499720f09aaa0ee53321facfb199f2c3234acabc101127ae22bbd4fa90bb1d)\nThis package was compromised and malicious code added as part of a phishing\ncampaign.\n","modified":"2025-09-11T03:58:52Z","published":"2025-09-11T03:58:52Z","database_specific":{"malicious-packages-origins":[{"sha256":"75499720f09aaa0ee53321facfb199f2c3234acabc101127ae22bbd4fa90bb1d","source":"google-open-source-security","versions":["2.0.1"],"import_time":"2025-09-11T03:59:18.968647Z","modified_time":"2025-09-11T03:58:52Z"}]},"references":[{"type":"ARTICLE","url":"https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"},{"type":"ARTICLE","url":"https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/"},{"type":"ARTICLE","url":"https://snyk.io/blog/npm-supply-chain-attack-via-open-source-maintainer-compromise/"}],"affected":[{"package":{"name":"@coveops/abi","ecosystem":"npm","purl":"pkg:npm/%40coveops/abi"},"versions":["2.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@coveops/abi/MAL-2025-47025.json"}}],"schema_version":"1.7.3"}