MAL-2025-49308

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/u8ymp15aglfp7y/MAL-2025-49308.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-49308
Published
2025-11-01T02:10:31Z
Modified
2025-11-03T19:06:19Z
Summary
Malicious code in u8ymp15aglfp7y (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d3d0583d85e1bebaa0c44fe4ef6e449c155b034a7146cf881a9bf27d5e8b7b7b)

The package u8ymp15aglfp7y was found to contain malicious code.

Source: ossf-package-analysis (db68cbed6b3fbc67489a8d3415d1dcc3e78d00911b67cd358dc687e4b1cd306b)

The OpenSSF Package Analysis project identified 'u8ymp15aglfp7y' @ 0.0.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-11-01T02:36:36.544456395Z",
            "modified_time": "2025-11-01T02:10:31Z",
            "sha256": "db68cbed6b3fbc67489a8d3415d1dcc3e78d00911b67cd358dc687e4b1cd306b",
            "source": "ossf-package-analysis",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "import_time": "2025-11-03T19:05:49.731469972Z",
            "modified_time": "2025-11-03T18:59:00Z",
            "sha256": "d3d0583d85e1bebaa0c44fe4ef6e449c155b034a7146cf881a9bf27d5e8b7b7b",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
Credits

Affected packages

npm / u8ymp15aglfp7y

Package

Name
u8ymp15aglfp7y
View open source insights on deps.dev
Purl
pkg:npm/u8ymp15aglfp7y

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/u8ymp15aglfp7y/MAL-2025-49308.json"