{"id":"MAL-2025-47026","summary":"Malicious code in prebid (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52)\nThis package was compromised and malicious code added as part of a phishing\ncampaign.\n","modified":"2025-09-26T11:06:45Z","published":"2025-09-11T03:58:52Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-09-11T03:59:18.944527Z","modified_time":"2025-09-11T03:58:52Z","sha256":"14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52","source":"google-open-source-security","versions":["10.9.2","10.9.1"]},{"id":"RLMA-2025-05128","import_time":"2025-09-26T11:06:01.863061792Z","modified_time":"2025-09-26T09:40:05Z","sha256":"cb5864309ee640c7174dbb6cccfc47f6ef2b2d2c94914b09a0c5d14da13179a3","source":"reversing-labs","versions":["10.9.1","10.9.2"]}]},"references":[{"type":"ARTICLE","url":"https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"},{"type":"ARTICLE","url":"https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/"},{"type":"ARTICLE","url":"https://snyk.io/blog/npm-supply-chain-attack-via-open-source-maintainer-compromise/"},{"type":"ARTICLE","url":"https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack"},{"type":"WEB","url":"https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"}],"affected":[{"package":{"name":"prebid","ecosystem":"npm","purl":"pkg:npm/prebid"},"versions":["10.9.2","10.9.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prebid/MAL-2025-47026.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}