MAL-2025-49243

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ve.zz/MAL-2025-49243.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-49243
Published
2025-10-30T17:38:57Z
Modified
2025-12-02T10:11:32Z
Summary
Malicious code in ve.zz (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9c8e2a95c2e552463055500ef58802c8dc7f83bd43774593724692cdc43d9a93)

The package ve.zz was found to contain malicious code.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2025-10-30T18:08:38.947394134Z",
            "modified_time":  "2025-10-30T17:38:57Z",
            "ranges":  [
                {
                    "events":  [
                        {
                            "introduced":  "0"
                        }
                    ],
                    "type":  "SEMVER"
                }
            ],
            "sha256":  "9c8e2a95c2e552463055500ef58802c8dc7f83bd43774593724692cdc43d9a93",
            "source":  "amazon-inspector"
        },
        {
            "id":  "RLMA-2025-05977",
            "import_time":  "2025-12-02T09:09:56.020115979Z",
            "modified_time":  "2025-12-01T13:28:53Z",
            "sha256":  "2c194102c92211d4bbbf7d81f903322bc8a643b8a4060e70f0a796fb6b211ec4",
            "source":  "reversing-labs",
            "versions":  [
                "1.0.0",
                "1.0.5",
                "1.1.0",
                "1.2.0",
                "1.2.5",
                "1.7.5",
                "2.7.5",
                "4.7.5",
                "4.7.6",
                "4.7.7",
                "4.7.8",
                "5.0.0",
                "5.1.0",
                "5.1.2",
                "5.1.3",
                "5.1.4",
                "5.1.5",
                "5.1.6",
                "5.1.7",
                "5.1.8",
                "5.2.0",
                "5.2.1",
                "5.2.2"
            ]
        }
    ]
}
Credits

Affected packages

npm / ve.zz

Package

Name
ve.zz
View open source insights on deps.dev
Purl
pkg:npm/ve.zz

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.5
1.1.0
1.2.0
1.2.5
1.7.5
2.*
2.7.5
4.*
4.7.5
4.7.6
4.7.7
4.7.8
5.*
5.0.0
5.1.0
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.2.0
5.2.1
5.2.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ve.zz/MAL-2025-49243.json"