MAL-2025-14109

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/adorn/MAL-2025-14109.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-14109
Published
2025-08-14T18:52:04Z
Modified
2026-10-29T14:45:05Z
Summary
Malicious code in adorn (npm)
Details

The package adorn was found to contain malicious code.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a)

No install-time or import-time behavior of concern was observed in this package version. No lifecycle scripts performing network fetch or shell execution, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment-variable scraping, no hardcoded attacker-controlled network destinations, no obfuscated payloads, and no silent-relay of caller-supplied data were identified.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022327",
            "import_time": "2026-10-29T14:37:04.04850611Z",
            "modified_time": "2026-10-29T14:18:26Z",
            "sha256": "2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022325",
            "import_time": "2026-10-29T14:37:03.964491023Z",
            "modified_time": "2026-10-29T14:18:08Z",
            "sha256": "e599d9e6ee3f5d7eb08a02b4dded1fe4a169ac106e857aeee90f7ad162a52913",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / adorn

Package

Name
adorn
View open source insights on deps.dev
Purl
pkg:npm/adorn

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.1.0
0.1.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "adorn-0.1.0.tgz",
            "hashes": {
                "sha1": "687bf58e85cacd8f4357ad1bcf66b9417de9a469",
                "sha512_sri": "sha512-dzMURzEkao4rVH7aIa5Q32yI36xwwW9usovindp4ot6aEQNbZYUGGF1+6UGtKgloiws0GDX9OR7wkiNo0OhFcg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/adorn/MAL-2025-14109.json"