MAL-2025-192201

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/elf-stats-merry-garland-548/MAL-2025-192201.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192201
Published
2025-12-03T16:32:02Z
Modified
2025-12-23T22:06:09Z
Summary
Malicious code in elf-stats-merry-garland-548 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f5b0446bc7b428d52a072e60b18969e2e9b35f19d70d6a77bc8176e76dd14506)

The package elf-stats-merry-garland-548 was found to contain malicious code.

Source: ossf-package-analysis (03708b81d9c3c399b037b2d76317b4259fff76f0b4fb9f6e6472226d89698749)

The OpenSSF Package Analysis project identified 'elf-stats-merry-garland-548' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-12-03T16:44:20.643753635Z",
            "modified_time": "2025-12-03T16:32:02Z",
            "sha256": "03708b81d9c3c399b037b2d76317b4259fff76f0b4fb9f6e6472226d89698749",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2025-12-03T16:44:20.90224718Z",
            "modified_time": "2025-12-03T16:40:56Z",
            "sha256": "9462fbff3d400250e397360a35e647a30d4cae891bbc26fe163614be4c8a511f",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2025-12-03T17:09:18.985049461Z",
            "modified_time": "2025-12-03T16:45:36Z",
            "sha256": "2099c52bf3968e382d050375499f008debbb209dafd5197077134baf14f9c280",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "import_time": "2025-12-03T18:10:08.401847517Z",
            "modified_time": "2025-12-03T17:50:51Z",
            "sha256": "f5b0446bc7b428d52a072e60b18969e2e9b35f19d70d6a77bc8176e76dd14506",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2"
            ]
        },
        {
            "id": "RLMA-2025-06233",
            "import_time": "2025-12-23T20:38:58.723943119Z",
            "modified_time": "2025-12-23T08:09:01Z",
            "sha256": "187551054ea4a7983eb1deda1a34726d0716ab34ee1e06cf8e28343e4a8cdf28",
            "source": "reversing-labs",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2"
            ]
        }
    ]
}
Credits

Affected packages

npm / elf-stats-merry-garland-548

Package

Name
elf-stats-merry-garland-548
View open source insights on deps.dev
Purl
pkg:npm/elf-stats-merry-garland-548

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/elf-stats-merry-garland-548/MAL-2025-192201.json"