MAL-2023-8160

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bbc-iplayer-sounds-chatbot/MAL-2023-8160.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2023-8160

Published

2023-09-19T13:50:43Z

Modified

2023-09-19T14:35:01Z

Summary

Malicious code in bbc-iplayer-sounds-chatbot (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a)

The OpenSSF Package Analysis project identified 'bbc-iplayer-sounds-chatbot' @ 5.2.3 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2023-09-19T13:55:46Z",
            "import_time": "2023-09-19T14:05:22.201038387Z",
            "source": "ossf-package-analysis",
            "sha256": "2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a",
            "versions": [
                "5.2.3"
            ]
        },
        {
            "modified_time": "2023-09-19T13:50:43Z",
            "import_time": "2023-09-19T14:05:22.042564684Z",
            "source": "ossf-package-analysis",
            "sha256": "ea9e5d55fcfc5fd20fe718f031e2ca274f6890f54db23f04d9026ea4386475bc",
            "versions": [
                "7.2.3"
            ]
        },
        {
            "modified_time": "2023-09-19T14:14:06Z",
            "import_time": "2023-09-19T14:34:33.47179342Z",
            "source": "ossf-package-analysis",
            "sha256": "bc0cead55e9b5f6bb939d5ff6fcdee0880185668373bfb728eb7b565452d02bf",
            "versions": [
                "1.2.3"
            ]
        }
    ]
}

References

Credits

- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / bbc-iplayer-sounds-chatbot

Package

Name: bbc-iplayer-sounds-chatbot; View open source insights on deps.dev
Purl: pkg:npm/bbc-iplayer-sounds-chatbot

Affected ranges

Affected versions

1.*

1.2.3

5.*

5.2.3

7.*

7.2.3

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bbc-iplayer-sounds-chatbot/MAL-2023-8160.json"