MAL-2025-350

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@chkpkit/box/MAL-2025-350.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-350
Published
2025-01-23T12:56:05Z
Modified
2025-01-29T12:09:00Z
Summary
Malicious code in @chkpkit/box (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (be611a64a4693f32ee325101273c6edec5fc7c62e14b8455d75bb5014f2a0379)

The OpenSSF Package Analysis project identified '@chkpkit/box' @ 99.99.93 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-01-23T13:08:56.725224971Z",
            "modified_time": "2025-01-23T12:56:05Z",
            "sha256": "be611a64a4693f32ee325101273c6edec5fc7c62e14b8455d75bb5014f2a0379",
            "source": "ossf-package-analysis",
            "versions": [
                "99.99.93"
            ]
        },
        {
            "import_time": "2025-01-27T13:08:41.807489699Z",
            "modified_time": "2025-01-27T12:46:19Z",
            "sha256": "8b2422f38a1df2a762c4602368f3181b63d8c92ab0a283f07e2a767b0a4d7611",
            "source": "ossf-package-analysis",
            "versions": [
                "99.99.91"
            ]
        },
        {
            "import_time": "2025-01-29T12:08:31.795698396Z",
            "modified_time": "2025-01-29T11:46:03Z",
            "sha256": "40ff61b7968fadc0ef8586252a9fc1dde0b4c6def0740a3093a92e2dc6b7c6dd",
            "source": "ossf-package-analysis",
            "versions": [
                "99.99.89"
            ]
        }
    ]
}
Credits

Affected packages

npm / @chkpkit/box

Package

Name
@chkpkit/box
View open source insights on deps.dev
Purl
pkg:npm/%40chkpkit/box

Affected ranges

Affected versions

99.*
99.99.89
99.99.91
99.99.93

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@chkpkit/box/MAL-2025-350.json"