MAL-2025-192861

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/session-keeper/MAL-2025-192861.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192861
Aliases
  • SNYK-JS-SESSIONKEEPER-14152301
Published
2025-12-23T08:30:05Z
Modified
2026-03-19T12:48:04Z
Summary
Malicious code in session-keeper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6816e7c69a6752f4aeccba80eac83e7fd815e3388f21b4bfd007ccd6192dbc96)

The package session-keeper was found to contain malicious code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2025-06478",
            "import_time": "2025-12-24T10:07:27.557781844Z",
            "modified_time": "2025-12-23T08:30:05Z",
            "sha256": "9796e552c469adab7d20d2005b6e5d89b5c0625d6cd70beb932bb83250fab2de",
            "source": "reversing-labs",
            "versions": [
                "2.4.5",
                "2.5.5"
            ]
        },
        {
            "import_time": "2026-01-02T21:35:48.41600855Z",
            "modified_time": "2026-01-02T21:29:26Z",
            "sha256": "6816e7c69a6752f4aeccba80eac83e7fd815e3388f21b4bfd007ccd6192dbc96",
            "source": "amazon-inspector",
            "versions": [
                "2.4.5",
                "2.5.5"
            ]
        },
        {
            "id": "RLUA-2026-01559",
            "import_time": "2026-03-19T12:20:59.552064406Z",
            "modified_time": "2026-03-18T13:08:56Z",
            "sha256": "36c9a084822e58205fd29641345e07cde47d44621a5efd1a3aa55d93a5e21447",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / session-keeper

Package

Name
session-keeper
View open source insights on deps.dev
Purl
pkg:npm/session-keeper

Affected ranges

Affected versions

2.*
2.4.5
2.5.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/session-keeper/MAL-2025-192861.json"