{"id":"MAL-2025-55023","summary":"Malicious code in @rce-web/ui-upgrade-dialog (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57e62e8b0f953b91fb74e52a2d70374df46b221c1d7cc57bcc80e0671cf32796)\nThe package @rce-web/ui-upgrade-dialog was found to contain malicious code.\n\n## Source: ossf-package-analysis (48143b07a0f8012491524c11bebdf678fa36c9cb31bb75af3d73e8440e0b3f69)\nThe OpenSSF Package Analysis project identified '@rce-web/ui-upgrade-dialog' @ 1.5.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-11-12T02:38:44Z","published":"2025-11-10T16:31:05Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","import_time":"2025-11-10T16:42:07.836199219Z","modified_time":"2025-11-10T16:31:05Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"57e62e8b0f953b91fb74e52a2d70374df46b221c1d7cc57bcc80e0671cf32796"},{"source":"ossf-package-analysis","versions":["1.5.0"],"import_time":"2025-11-12T02:37:10.492225839Z","modified_time":"2025-11-10T16:35:56Z","sha256":"48143b07a0f8012491524c11bebdf678fa36c9cb31bb75af3d73e8440e0b3f69"}]},"affected":[{"package":{"name":"@rce-web/ui-upgrade-dialog","ecosystem":"npm","purl":"pkg:npm/%40rce-web/ui-upgrade-dialog"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.5.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rce-web/ui-upgrade-dialog/MAL-2025-55023.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}