MAL-2024-4

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/new-pro-anu/MAL-2024-4.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2024-4

Published

2024-01-01T18:57:31Z

Modified

2024-06-28T02:53:16Z

Summary

Malicious code in new-pro-anu (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (0b55891b547000b2110259388d7a21b3400ccd5815214318ed92c74acd78bf3c)

The OpenSSF Package Analysis project identified 'new-pro-anu' @ 1.2.8 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2024-01-01T19:02:24Z",
            "import_time": "2024-01-01T19:04:49.906937974Z",
            "source": "ossf-package-analysis",
            "sha256": "0b55891b547000b2110259388d7a21b3400ccd5815214318ed92c74acd78bf3c",
            "versions": [
                "1.2.8"
            ]
        },
        {
            "modified_time": "2024-01-01T18:57:31Z",
            "import_time": "2024-01-01T19:04:49.817163233Z",
            "source": "ossf-package-analysis",
            "sha256": "32bfad00800eaab2a4c2f7a7f8f42f8ebb61b7820f7cc21613bed85d2a852ae2",
            "versions": [
                "1.2.9"
            ]
        },
        {
            "modified_time": "2024-01-01T19:33:55Z",
            "import_time": "2024-01-01T20:04:46.898555474Z",
            "source": "ossf-package-analysis",
            "sha256": "20b16d05d8271cf18455e55f5a8f1c9bad0d3d8f985a71d322e18e2a7b1c4cca",
            "versions": [
                "1.3.0"
            ]
        },
        {
            "id": "RLMA-2024-01388",
            "modified_time": "2024-06-25T12:51:28Z",
            "import_time": "2024-06-28T02:44:01.438035565Z",
            "source": "reversing-labs",
            "sha256": "1aedf4b5d59576a7c622833f6142fefa8a8a67d1999cec99e773ca598791621c",
            "versions": [
                "1.2.9",
                "1.2.8",
                "1.2.5",
                "1.3.0",
                "1.2.6"
            ]
        }
    ]
}

References

Credits

- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / new-pro-anu

Package

Name: new-pro-anu; View open source insights on deps.dev
Purl: pkg:npm/new-pro-anu

Affected ranges

Affected versions

1.*

1.2.5

1.2.6

1.2.8

1.2.9

1.3.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/new-pro-anu/MAL-2024-4.json"