{"id":"MAL-2026-873","summary":"Malicious code in @depro0x/despicable-me (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9)\nThe package @depro0x/despicable-me was found to contain malicious code.\n\n## Source: ossf-package-analysis (4615e7677b737a414d7c43332b795fe84cb5d272e491befba14d42456ae28cfc)\nThe OpenSSF Package Analysis project identified '@depro0x/despicable-me' @ 11.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-03-23T04:55:33.755841Z","published":"2026-02-12T20:40:54Z","database_specific":{"malicious-packages-origins":[{"versions":["8.0.0"],"import_time":"2026-02-12T20:46:27.750833393Z","modified_time":"2026-02-12T20:40:54Z","sha256":"6462180066b4c25e184d616993e44ba94d6e6fdf065db3e0e6ce52a1015a0aa0","source":"ossf-package-analysis"},{"source":"ossf-package-analysis","versions":["14.0.0"],"import_time":"2026-02-12T21:13:09.941100803Z","modified_time":"2026-02-12T21:04:06Z","sha256":"408ee2d3c535747e02e11f32f8a20bafa12ddc1ac413c41dc80ed7375e926b02"},{"source":"ossf-package-analysis","versions":["9.0.0"],"import_time":"2026-02-12T21:13:09.774236826Z","modified_time":"2026-02-12T20:47:18Z","sha256":"e5e59fdbcd5eae4cddc95424e34ba5de09ae15fd2d265fcf832a68c4c4495a4a"},{"import_time":"2026-02-12T21:45:29.334645302Z","modified_time":"2026-02-12T21:37:57Z","sha256":"4615e7677b737a414d7c43332b795fe84cb5d272e491befba14d42456ae28cfc","source":"ossf-package-analysis","versions":["11.0.0"]},{"versions":["13.0.0"],"import_time":"2026-02-12T21:45:29.187884531Z","modified_time":"2026-02-12T21:29:31Z","sha256":"9d4f645b4e971818c96437326820425423bc5c41700995b66b0a6d96d110f145","source":"ossf-package-analysis"},{"import_time":"2026-02-12T21:45:29.076722365Z","modified_time":"2026-02-12T21:21:01Z","sha256":"cfd0bd7743a9548666d2cb6e0bbe7392bde2f52356f29403ba18b846c2f6c8d0","source":"ossf-package-analysis","versions":["16.0.0"]},{"sha256":"3fc28a0966ecc924884cf1cd6a75caf42b173878d6934a7f4774e294fba62ccd","source":"ossf-package-analysis","versions":["6.0.0"],"import_time":"2026-02-12T22:45:32.411452612Z","modified_time":"2026-02-12T22:19:52Z"},{"versions":["8.0.0","14.0.0","9.0.0","11.0.0","13.0.0","16.0.0","6.0.0"],"import_time":"2026-02-23T04:19:45.059722132Z","modified_time":"2026-02-23T03:51:30Z","sha256":"0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9","source":"amazon-inspector"}]},"affected":[{"package":{"name":"@depro0x/despicable-me","ecosystem":"npm","purl":"pkg:npm/%40depro0x/despicable-me"},"versions":["8.0.0","14.0.0","9.0.0","11.0.0","13.0.0","16.0.0","6.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@depro0x/despicable-me/MAL-2026-873.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}