MAL-2025-48638

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dhemrdhs92010/MAL-2025-48638.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-48638

Published

2025-10-26T19:03:27Z

Modified

2025-12-02T10:09:27.458287Z

Summary

Malicious code in dhemrdhs92010 (npm)

Details

The package dhemrdhs92010 was found to contain malicious code.

-= Per source details. Do not edit below this line.=-

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2025-12-01T13:07:42Z",
            "sha256": "5ceb23a609348bc49f8355c0fb5aa8ad822c332fec8bd20fad9e871fb5f7b264",
            "versions": [
                "1.250726.11840",
                "1.250809.11454",
                "1.250809.11500",
                "1.250809.11634",
                "1.250809.11649",
                "1.250809.11749",
                "1.250809.11750",
                "1.250810.11129",
                "1.250810.12016",
                "1.250810.12027",
                "1.250813.11347",
                "1.250815.12016",
                "1.250817.11013",
                "1.250817.11923",
                "1.250821.10855",
                "1.250821.11342",
                "1.250910.11843",
                "1.250917.11518",
                "1.250917.11920",
                "1.250924.11150"
            ],
            "import_time": "2025-12-02T09:09:44.8141301Z",
            "source": "reversing-labs",
            "id": "RLMA-2025-05735"
        }
    ]
}

References

https://www.getsafety.com/blog-posts/javascript-rat-targets-banks

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / dhemrdhs92010

Package

Name: dhemrdhs92010; View open source insights on deps.dev
Purl: pkg:npm/dhemrdhs92010

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.250726.11840

1.250809.11454

1.250809.11500

1.250809.11634

1.250809.11649

1.250809.11749

1.250809.11750

1.250810.11129

1.250810.12016

1.250810.12027

1.250813.11347

1.250815.12016

1.250817.11013

1.250817.11923

1.250821.10855

1.250821.11342

1.250910.11843

1.250917.11518

1.250917.11920

1.250924.11150

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dhemrdhs92010/MAL-2025-48638.json"