{"id":"MAL-2025-49319","summary":"Malicious code in web3-1-4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f8b0f3301c4d4556f7e8700121e0fa272e12f9fa0f75868720564356cdde51ed)\nThe package web3-1-4 was found to contain malicious code.\n\n## Source: ossf-package-analysis (f0b7de317eb19a16988312db7d209ce5d387fdf8c4eed8d1bf62872b4bad38ea)\nThe OpenSSF Package Analysis project identified 'web3-1-4' @ 5.0.9 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-11-03T19:06:19Z","published":"2025-11-02T19:57:49Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["5.0.9"],"import_time":"2025-11-02T23:34:48.584153163Z","modified_time":"2025-11-02T19:57:49Z","sha256":"f0b7de317eb19a16988312db7d209ce5d387fdf8c4eed8d1bf62872b4bad38ea"},{"import_time":"2025-11-03T19:05:52.706910345Z","modified_time":"2025-11-03T18:59:00Z","sha256":"f8b0f3301c4d4556f7e8700121e0fa272e12f9fa0f75868720564356cdde51ed","source":"amazon-inspector","versions":["5.0.8","5.0.9"]}]},"affected":[{"package":{"name":"web3-1-4","ecosystem":"npm","purl":"pkg:npm/web3-1-4"},"versions":["5.0.9","5.0.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web3-1-4/MAL-2025-49319.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}