{"id":"MAL-2026-914","summary":"Malicious code in @qualys/react-web (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c63e27e2c86203c152f6f7bfc30136a44d93bfbc84522fcf86ca97976511a59)\nThe package @qualys/react-web was found to contain malicious code.\n\n## Source: ossf-package-analysis (c34121468e92fda61a11befd4ca6253a635ae9470b89c6ccf4e155c32e9ebc1b)\nThe OpenSSF Package Analysis project identified '@qualys/react-web' @ 5.4.3-2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-03-23T04:54:03.222025Z","published":"2026-02-16T08:50:48Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-02-16T09:23:48.846675496Z","modified_time":"2026-02-16T08:50:48Z","sha256":"c34121468e92fda61a11befd4ca6253a635ae9470b89c6ccf4e155c32e9ebc1b","source":"ossf-package-analysis","versions":["5.4.3-2"]},{"import_time":"2026-02-23T04:19:44.604797587Z","modified_time":"2026-02-23T03:51:30Z","sha256":"5c63e27e2c86203c152f6f7bfc30136a44d93bfbc84522fcf86ca97976511a59","source":"amazon-inspector","versions":["5.4.3-2"]}]},"affected":[{"package":{"name":"@qualys/react-web","ecosystem":"npm","purl":"pkg:npm/%40qualys/react-web"},"versions":["5.4.3-2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@qualys/react-web/MAL-2026-914.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}