{"id":"MAL-2025-6225","summary":"Malicious code in xk6-top (npm)","details":"The package communicates with a domain associated with malicious activity.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (14bf109f34ed2a77090e261e001bc285f9e3c59006cb9c2ccf14f34fda5ff61e)\nThe OpenSSF Package Analysis project identified 'xk6-top' @ 10.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2025-07-28T01:58:37Z","published":"2025-07-24T14:21:08Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2025-07-24T15:05:56Z","sha256":"14bf109f34ed2a77090e261e001bc285f9e3c59006cb9c2ccf14f34fda5ff61e","source":"ossf-package-analysis","versions":["10.1.1"],"import_time":"2025-07-24T15:06:48.298720546Z"}]},"affected":[{"package":{"name":"xk6-top","ecosystem":"npm","purl":"pkg:npm/xk6-top"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.1"}]}],"versions":["10.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xk6-top/MAL-2025-6225.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}