MAL-2024-1048

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apics/apps-ppp-web/MAL-2024-1048.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2024-1048

Published

2024-03-01T14:55:54Z

Modified

2024-03-03T21:04:45Z

Summary

Malicious code in @apics/apps-ppp-web (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (a11545fc54b4d0cdd2e0e8de4ab835b254677aff86d325e9bec6a0a6b5e090a8)

The OpenSSF Package Analysis project identified '@apics/apps-ppp-web' @ 9.39.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2024-03-01T15:04:49.653759625Z",
            "modified_time": "2024-03-01T14:55:54Z",
            "sha256": "69dfab3bed458cb7101c09908991f9538d3f114ee24ec01fb91ab7fb365a1265",
            "source": "ossf-package-analysis",
            "versions": [
                "9.34.0"
            ]
        },
        {
            "import_time": "2024-03-01T20:05:33.487432334Z",
            "modified_time": "2024-03-01T19:39:41Z",
            "sha256": "422a327c66b99432969f00d1b7fb11495705c862786637a95e4df268a1fa03d6",
            "source": "ossf-package-analysis",
            "versions": [
                "9.37.0"
            ]
        },
        {
            "import_time": "2024-03-01T20:05:33.589335695Z",
            "modified_time": "2024-03-01T20:00:52Z",
            "sha256": "a50160c9b2d30476cfbe438fc61feda78b568c1b2601ff846b514ded5a416c12",
            "source": "ossf-package-analysis",
            "versions": [
                "9.39.0"
            ]
        },
        {
            "import_time": "2024-03-02T21:04:43.488136981Z",
            "modified_time": "2024-03-02T20:58:03Z",
            "sha256": "a11545fc54b4d0cdd2e0e8de4ab835b254677aff86d325e9bec6a0a6b5e090a8",
            "source": "ossf-package-analysis",
            "versions": [
                "9.39.1"
            ]
        },
        {
            "import_time": "2024-03-03T21:04:30.041978357Z",
            "modified_time": "2024-03-03T20:51:42Z",
            "sha256": "fcd58064284c44f909b3b2978eb5710cab99dade8debb01b36332112d52f69fc",
            "source": "ossf-package-analysis",
            "versions": [
                "9.39.2"
            ]
        }
    ]
}

Credits

- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / @apics/apps-ppp-web

Package

Name: @apics/apps-ppp-web; View open source insights on deps.dev
Purl: pkg:npm/%40apics/apps-ppp-web

Affected ranges

Affected versions

9.*

9.34.0

9.37.0

9.39.0

9.39.1

9.39.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apics/apps-ppp-web/MAL-2024-1048.json"