MAL-2025-192377

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gs-uitk-lodash/MAL-2025-192377.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192377
Published
2025-12-08T15:40:53Z
Modified
2025-12-11T09:51:05Z
Summary
Malicious code in gs-uitk-lodash (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b)

The package gs-uitk-lodash was found to contain malicious code.

Source: ossf-package-analysis (c89a6d85d1019b9d98f88e94d18fd4ec4ae045bd6f941941e9bdde517a749fdd)

The OpenSSF Package Analysis project identified 'gs-uitk-lodash' @ 35.3.3 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-12-08T16:08:29.958933342Z",
            "modified_time": "2025-12-08T15:40:53Z",
            "sha256": "c89a6d85d1019b9d98f88e94d18fd4ec4ae045bd6f941941e9bdde517a749fdd",
            "source": "ossf-package-analysis",
            "versions": [
                "35.3.3"
            ]
        },
        {
            "import_time": "2025-12-08T16:08:30.077469565Z",
            "modified_time": "2025-12-08T16:06:53Z",
            "sha256": "feecd7d802ec19931f6a91819521c5409d84adc3ee12e026f16c3f2df1384d9c",
            "source": "ossf-package-analysis",
            "versions": [
                "35.9.9"
            ]
        },
        {
            "import_time": "2025-12-08T19:06:06.211904685Z",
            "modified_time": "2025-12-08T19:05:44Z",
            "sha256": "46e71552359a176c9f4bc6782c7b12187277a490a81a2881048183f04ab8b68c",
            "source": "ossf-package-analysis",
            "versions": [
                "36.0.0"
            ]
        },
        {
            "import_time": "2025-12-10T21:07:48.629077667Z",
            "modified_time": "2025-12-10T21:03:50Z",
            "sha256": "2de2e606bc9fde8de540caf63cbded837e1bbbd7bc6bd2d477e38dcf89a76f0b",
            "source": "amazon-inspector",
            "versions": [
                "35.3.3",
                "35.9.9",
                "36.0.0"
            ]
        },
        {
            "import_time": "2025-12-11T02:41:24.357278286Z",
            "modified_time": "2025-12-11T01:47:51Z",
            "sha256": "5109d6f496cd17ca9aded3a571a11af77a39e9f7662a839406e290e959b4a409",
            "source": "amazon-inspector",
            "versions": [
                "33.3.3"
            ]
        }
    ]
}
Credits

Affected packages

npm / gs-uitk-lodash

Package

Name
gs-uitk-lodash
View open source insights on deps.dev
Purl
pkg:npm/gs-uitk-lodash

Affected ranges

Affected versions

33.*
33.3.3
35.*
35.3.3
35.9.9
36.*
36.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gs-uitk-lodash/MAL-2025-192377.json"