MAL-2025-49243

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ve.zz/MAL-2025-49243.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-49243
Published
2025-10-30T17:38:57Z
Modified
2025-12-02T10:11:32.225857Z
Summary
Malicious code in ve.zz (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9c8e2a95c2e552463055500ef58802c8dc7f83bd43774593724692cdc43d9a93)

The package ve.zz was found to contain malicious code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-10-30T18:08:38.947394134Z",
            "source": "amazon-inspector",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "modified_time": "2025-10-30T17:38:57Z",
            "sha256": "9c8e2a95c2e552463055500ef58802c8dc7f83bd43774593724692cdc43d9a93"
        },
        {
            "import_time": "2025-12-02T09:09:56.020115979Z",
            "id": "RLMA-2025-05977",
            "versions": [
                "1.0.0",
                "1.0.5",
                "1.1.0",
                "1.2.0",
                "1.2.5",
                "1.7.5",
                "2.7.5",
                "4.7.5",
                "4.7.6",
                "4.7.7",
                "4.7.8",
                "5.0.0",
                "5.1.0",
                "5.1.2",
                "5.1.3",
                "5.1.4",
                "5.1.5",
                "5.1.6",
                "5.1.7",
                "5.1.8",
                "5.2.0",
                "5.2.1",
                "5.2.2"
            ],
            "source": "reversing-labs",
            "modified_time": "2025-12-01T13:28:53Z",
            "sha256": "2c194102c92211d4bbbf7d81f903322bc8a643b8a4060e70f0a796fb6b211ec4"
        }
    ]
}
References
Credits

Affected packages

npm / ve.zz

Package

Name
ve.zz
View open source insights on deps.dev
Purl
pkg:npm/ve.zz

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.5
1.1.0
1.2.0
1.2.5
1.7.5
2.*
2.7.5
4.*
4.7.5
4.7.6
4.7.7
4.7.8
5.*
5.0.0
5.1.0
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.2.0
5.2.1
5.2.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ve.zz/MAL-2025-49243.json"