MAL-2025-48701

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ldhemrdhs60152/MAL-2025-48701.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-48701

Published

2025-10-26T19:03:27Z

Modified

2025-12-02T10:10:14.909248Z

Summary

Malicious code in ldhemrdhs60152 (npm)

Details

The package ldhemrdhs60152 was found to contain malicious code.

-= Per source details. Do not edit below this line.=-

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2025-05830",
            "import_time": "2025-12-02T09:09:48.99835664Z",
            "sha256": "c00e2cf146624db7b904580e5332b8ff4168a7e006870c88ee0dbac68f6bdebe",
            "source": "reversing-labs",
            "modified_time": "2025-12-01T13:15:15Z",
            "versions": [
                "1.250915.11001",
                "1.250915.11350",
                "1.250915.11513",
                "1.250915.11514",
                "1.250915.11830",
                "1.250916.10756",
                "1.250916.11429",
                "1.250917.10801",
                "1.250917.11419",
                "1.250917.11921",
                "1.250918.10827",
                "1.250918.10942",
                "1.250918.11557",
                "1.250918.11814",
                "1.250921.11826",
                "1.250923.10851",
                "1.250923.11033",
                "1.250926.11414",
                "1.251021.10755",
                "1.251021.11516",
                "1.251021.11520",
                "1.251022.11335"
            ]
        }
    ]
}

References

https://www.getsafety.com/blog-posts/javascript-rat-targets-banks

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / ldhemrdhs60152

Package

Name: ldhemrdhs60152; View open source insights on deps.dev
Purl: pkg:npm/ldhemrdhs60152

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.250915.11001

1.250915.11350

1.250915.11513

1.250915.11514

1.250915.11830

1.250916.10756

1.250916.11429

1.250917.10801

1.250917.11419

1.250917.11921

1.250918.10827

1.250918.10942

1.250918.11557

1.250918.11814

1.250921.11826

1.250923.10851

1.250923.11033

1.250926.11414

1.251021.10755

1.251021.11516

1.251021.11520

1.251022.11335

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ldhemrdhs60152/MAL-2025-48701.json"