{"id":"MAL-2026-15868","summary":"Malicious code in @bx-ui-framework/microfrontend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30)\npackage.json declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL at `https://repo.artifactorymanager.com/bx-ui-framework/microfrontend` rather than a version on the npm registry. The URL carries no version, commit, or hash pin, so `npm install` fetches whatever tarball is currently served at that location and executes any lifecycle scripts and code it contains inside the installer's dependency tree. The `artifactorymanager.com` domain is unrelated to any established publisher for this scope, and the tarball contents can change at any time without a version bump.\n","modified":"2026-09-04T01:30:05.150247004Z","published":"2026-09-04T01:12:00Z","database_specific":{"malicious-packages-origins":[{"sha256":"e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30","source":"amazon-inspector","versions":["15.0.0"],"id":"IN-MAL-2026-019403","import_time":"2026-09-04T01:24:41.110013005Z","modified_time":"2026-09-04T01:12:00Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bx-ui-framework/microfrontend/v/15.0.0"}],"affected":[{"package":{"name":"@bx-ui-framework/microfrontend","ecosystem":"npm","purl":"pkg:npm/%40bx-ui-framework/microfrontend"},"versions":["15.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bx-ui-framework/microfrontend/MAL-2026-15868.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"d9e0ed3104604cb39acb4691ac6aa61a76924b3b5408bc1552ce442892eaab718fe36c","path":"package.json","sha256":"2c5a09331345eb2803037ccadb50a9c946064e5f069b9f80fb4b3adf79aa64ac"}],"package_integrity":[{"hashes":{"sha1":"b789aa1a4c17eb1b45e2a4d20988b2b427c7d5c4","sha512_sri":"sha512-zooV46lFD10gqjExiM63G49Bdo0uB7W7eSE/Qt9eMYEoNRE4V/00FSPAleyxrhRxSgapVaLAgqqzgPZ1+ap+qw=="},"filename":"microfrontend-15.0.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}