MAL-2025-4584

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/arc-offsec-custom-library2/MAL-2025-4584.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-4584

Published

2025-05-29T13:44:00Z

Modified

2025-08-01T10:42:04Z

Summary

Malicious code in arc-offsec-custom-library2 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (a8fa793672d2e0686853c58a6768867a936971cb91561c3a1cbcebda67c22121)

The OpenSSF Package Analysis project identified 'arc-offsec-custom-library2' @ 1.0.9 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.9"
            ],
            "sha256": "a8fa793672d2e0686853c58a6768867a936971cb91561c3a1cbcebda67c22121",
            "modified_time": "2025-05-29T13:44:00Z",
            "source": "ossf-package-analysis",
            "import_time": "2025-05-29T14:06:09.131450917Z"
        },
        {
            "versions": [
                "1.0.0",
                "1.0.1"
            ],
            "sha256": "83cb4841d8e32a92db1b31cafb69db9265a8480610e6bdb1b531d96d97ffe464",
            "modified_time": "2025-06-18T10:21:51Z",
            "source": "reversing-labs",
            "id": "RLMA-2025-03074",
            "import_time": "2025-06-18T15:06:06.710597452Z"
        },
        {
            "versions": [
                "1.0.9"
            ],
            "sha256": "ea350273edbb3b119b77147ab98f032eec5466f38bd1f8f00dc99296080cebf4",
            "modified_time": "2025-07-31T19:24:30Z",
            "source": "reversing-labs",
            "id": "RLUA-2025-03772",
            "import_time": "2025-08-01T10:41:35.830014857Z"
        }
    ]
}

References

Credits

- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / arc-offsec-custom-library2

Package

Name: arc-offsec-custom-library2; View open source insights on deps.dev
Purl: pkg:npm/arc-offsec-custom-library2

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.9

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/arc-offsec-custom-library2/MAL-2025-4584.json"