{"id":"MAL-2026-466","summary":"Malicious code in uuu8lgd (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920)\nThe package uuu8lgd was found to contain malicious code.\n\n## Source: ossf-package-analysis (07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2)\nThe OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-01-23T01:53:43.408763Z","published":"2026-01-22T17:51:00Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["1.0.2"],"import_time":"2026-01-22T18:09:51.138487865Z","modified_time":"2026-01-22T17:55:49Z","sha256":"aa4d9125702fd82fb441bb84144f6be9c8a907df6dafbf8763298164d2eac64e"},{"source":"ossf-package-analysis","versions":["1.0.1"],"import_time":"2026-01-22T18:09:51.019214216Z","modified_time":"2026-01-22T17:51:00Z","sha256":"f21287ddfeceba75b1d61a1ee1fee1952269d2b5a919db08f079e0fd8ccbcdad"},{"import_time":"2026-01-22T18:46:55.541958019Z","modified_time":"2026-01-22T18:37:28Z","sha256":"07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2","source":"ossf-package-analysis","versions":["1.0.10"]},{"modified_time":"2026-01-22T18:13:45Z","sha256":"3fdea801a42a9d0815992cfbd09c19069aea4a5e3fa82310a4f1715e2128c620","source":"ossf-package-analysis","versions":["1.0.7"],"import_time":"2026-01-22T18:46:55.410980561Z"},{"source":"ossf-package-analysis","versions":["1.0.11"],"import_time":"2026-01-22T18:46:55.711685222Z","modified_time":"2026-01-22T18:40:46Z","sha256":"d7d2feee8eec94e337eaff29127d096cdbbdd368ad9127e8110c2009fbb5499f"},{"import_time":"2026-01-22T19:10:29.598224175Z","modified_time":"2026-01-22T18:57:31Z","sha256":"d3cd4504da698fcf215d47ceadcf35ebd73593e4c0616e481fef430981dffad5","source":"ossf-package-analysis","versions":["1.0.14"]},{"source":"ossf-package-analysis","versions":["1.0.17"],"import_time":"2026-01-22T19:39:15.536150376Z","modified_time":"2026-01-22T19:16:06Z","sha256":"34100015b0ba37489e9dd70d0c7a246b183ecaeb11ee9aeea197922915433201"},{"import_time":"2026-01-22T19:39:15.710819514Z","modified_time":"2026-01-22T19:35:54Z","sha256":"43b84c3ddb9c30dfe6860ac38e3771ba6a9fd0478e3d16dcb39c340a524298b5","source":"ossf-package-analysis","versions":["1.0.19"]},{"import_time":"2026-01-22T20:08:05.159991024Z","modified_time":"2026-01-22T19:55:29Z","sha256":"70bfbe5be9f3bb2fdb58474beb0aee2cacde9bd59ea518de5ed291eb7270b4f2","source":"ossf-package-analysis","versions":["1.0.22"]},{"versions":["1.0.24"],"import_time":"2026-01-22T20:42:32.633062688Z","modified_time":"2026-01-22T20:22:45Z","sha256":"2469f8a646b986709263e1d49dc00ead1623d19bac17e3288eed4f8480ee121a","source":"ossf-package-analysis"},{"import_time":"2026-01-23T01:36:52.478493641Z","modified_time":"2026-01-23T01:13:12Z","sha256":"1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920","source":"amazon-inspector","versions":["1.0.2","1.0.1","1.0.10","1.0.7","1.0.11","1.0.14","1.0.17","1.0.19","1.0.22","1.0.24"]}]},"affected":[{"package":{"name":"uuu8lgd","ecosystem":"npm","purl":"pkg:npm/uuu8lgd"},"versions":["1.0.2","1.0.1","1.0.10","1.0.7","1.0.11","1.0.14","1.0.17","1.0.19","1.0.22","1.0.24"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uuu8lgd/MAL-2026-466.json"}}],"schema_version":"1.7.3","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}