{"id":"MAL-2025-47389","summary":"Malicious code in @nativescript-community/ui-material-bottom-navigation (npm)","details":"The package was compromised and malicious code added.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (c1599f8fe4dad02bc9f083f9d6c3af166818ba3a80e2bb13c37a4052f581b81c)\nThis package was compromised by the Shai-Hulud NPM worm. The malicious payload\nsteals tokens and credentials and publishes them to GitHub before propogating\nitself to NPM packages the user owns.\n","modified":"2025-09-17T06:23:36Z","published":"2025-09-16T17:05:44Z","database_specific":{"malicious-packages-origins":[{"versions":["7.2.75","7.2.74","7.2.73","7.2.72"],"import_time":"2025-09-17T05:59:34.583354Z","modified_time":"2025-09-17T05:58:45Z","sha256":"c1599f8fe4dad02bc9f083f9d6c3af166818ba3a80e2bb13c37a4052f581b81c","source":"google-open-source-security"}]},"references":[{"type":"WEB","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"type":"WEB","url":"https://semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/"},{"type":"WEB","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"type":"WEB","url":"https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised"},{"type":"WEB","url":"https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"}],"affected":[{"package":{"name":"@nativescript-community/ui-material-bottom-navigation","ecosystem":"npm","purl":"pkg:npm/%40nativescript-community/ui-material-bottom-navigation"},"versions":["7.2.72","7.2.73","7.2.74","7.2.75"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nativescript-community/ui-material-bottom-navigation/MAL-2025-47389.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}