MAL-2023-8651

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/lodestone/MAL-2023-8651.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2023-8651
Withdrawn
2023-12-12T00:33:23Z
Published
2023-12-01T21:54:02Z
Modified
2023-12-12T00:33:23Z
Summary
Malicious code in lodestone (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (c5569d9f5d17acc6330446faa4b9f8eff7b389a4cde9698946b8473c5bd8e74e)

The OpenSSF Package Analysis project identified 'lodestone' @ 0.0.58 (pypi) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c5569d9f5d17acc6330446faa4b9f8eff7b389a4cde9698946b8473c5bd8e74e",
            "modified_time": "2023-12-01T21:54:02Z",
            "versions": [
                "0.0.58"
            ],
            "import_time": "2023-12-01T22:04:40.499043094Z",
            "source": "ossf-package-analysis"
        },
        {
            "sha256": "d8c4bbbf589e29dc93310a7ee2595d0b70eb43c0f8dcc1cf4ef8956a3bb2ea1b",
            "modified_time": "2023-12-01T22:13:31Z",
            "versions": [
                "0.0.59"
            ],
            "import_time": "2023-12-01T22:33:31.663621752Z",
            "source": "ossf-package-analysis"
        },
        {
            "sha256": "eafafe3b293d1e416cb3dea7e7459abc439e8fc3f8b8b2f17c3760c21cf68451",
            "modified_time": "2023-12-02T19:27:00Z",
            "versions": [
                "0.0.62"
            ],
            "import_time": "2023-12-02T19:33:21.569397859Z",
            "source": "ossf-package-analysis"
        },
        {
            "sha256": "c3abc2ec101099b77aefe472454218b0a7d41a32b8f99a233224d85128135f5d",
            "modified_time": "2023-12-02T21:04:33Z",
            "versions": [
                "0.0.63"
            ],
            "import_time": "2023-12-02T21:33:41.910685065Z",
            "source": "ossf-package-analysis"
        }
    ]
}
References
Credits

Affected packages

PyPI / lodestone

Package

Name
lodestone
View open source insights on deps.dev
Purl
pkg:pypi/lodestone

Affected ranges

Affected versions

0.*
0.0.58
0.0.59
0.0.62
0.0.63

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/lodestone/MAL-2023-8651.json"