{"id":"MAL-2025-49364","summary":"Malicious code in supply_chain_supplyer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ffb82b4b36d6e82b7dff16e757aab9bf7ffce58bcd579bd38ad7cdd98da4c3e5)\nThe package supply_chain_supplyer was found to contain malicious code.\n\n## Source: ossf-package-analysis (b325304f2661df4b70ef4c1dc2448aea916eca0bdf8b84e93bc51f60d26179f9)\nThe OpenSSF Package Analysis project identified 'supply_chain_supplyer' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2025-11-09T00:27:57Z","published":"2025-11-05T10:32:54Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-11-05T10:39:41.287866497Z","modified_time":"2025-11-05T10:32:54Z","sha256":"b325304f2661df4b70ef4c1dc2448aea916eca0bdf8b84e93bc51f60d26179f9","source":"ossf-package-analysis","versions":["99.0.0"]},{"source":"amazon-inspector","import_time":"2025-11-09T00:27:24.701097967Z","modified_time":"2025-11-09T00:17:09Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"ffb82b4b36d6e82b7dff16e757aab9bf7ffce58bcd579bd38ad7cdd98da4c3e5"}]},"affected":[{"package":{"name":"supply_chain_supplyer","ecosystem":"npm","purl":"pkg:npm/supply_chain_supplyer"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/supply_chain_supplyer/MAL-2025-49364.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}