{"id":"MAL-2025-61718","summary":"Malicious code in @rce-web/webpack-resource-plugin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7fd53e71efdc2208a44d689cb457a51c5dcdbe1518e27707d2e5c29e91d44da1)\nThe package @rce-web/webpack-resource-plugin was found to contain malicious code.\n\n## Source: ossf-package-analysis (f8bdc679f3ebe4383d138367ead81b3b3b57ec10d046818a1cf78d0ddba9d23a)\nThe OpenSSF Package Analysis project identified '@rce-web/webpack-resource-plugin' @ 1.5.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-11-12T02:38:44Z","published":"2025-11-10T20:21:21Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-11-11T00:31:26.012365557Z","modified_time":"2025-11-11T00:29:07Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"sha256":"7fd53e71efdc2208a44d689cb457a51c5dcdbe1518e27707d2e5c29e91d44da1","source":"amazon-inspector"},{"versions":["1.5.0"],"import_time":"2025-11-12T02:37:10.785288746Z","modified_time":"2025-11-10T20:21:21Z","sha256":"f8bdc679f3ebe4383d138367ead81b3b3b57ec10d046818a1cf78d0ddba9d23a","source":"ossf-package-analysis"}]},"affected":[{"package":{"name":"@rce-web/webpack-resource-plugin","ecosystem":"npm","purl":"pkg:npm/%40rce-web/webpack-resource-plugin"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.5.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rce-web/webpack-resource-plugin/MAL-2025-61718.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}