{"id":"MAL-2026-10778","summary":"Malicious code in relativity-pdfjs-dist (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (c48b9caf30af59020f36b25fb13fb54db5754b9d8ad311f857843171cc88915a)\nThe OpenSSF Package Analysis project identified 'relativity-pdfjs-dist' @ 5.8.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-07-18T10:19:42.445402731Z","published":"2026-07-18T09:05:46Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-18T09:06:04.067654953Z","modified_time":"2026-07-18T09:05:46Z","versions":["5.8.2"],"source":"ossf-package-analysis","sha256":"c48b9caf30af59020f36b25fb13fb54db5754b9d8ad311f857843171cc88915a"},{"sha256":"8a40319295154d72e1485a810cfd456ee7d44cabe572cba35912723f838edb65","import_time":"2026-07-18T10:03:28.709498049Z","modified_time":"2026-07-18T09:19:31Z","versions":["99.9.9"],"source":"ossf-package-analysis"}]},"affected":[{"package":{"name":"relativity-pdfjs-dist","ecosystem":"npm","purl":"pkg:npm/relativity-pdfjs-dist"},"versions":["5.8.2","99.9.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/relativity-pdfjs-dist/MAL-2026-10778.json"}}],"schema_version":"1.7.5","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}