MAL-2025-49731

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/post-purchase-frontend/MAL-2025-49731.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-49731

Published

2025-11-10T03:05:47Z

Modified

2025-11-10T05:39:52Z

Summary

Malicious code in post-purchase-frontend (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4)

The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These packages typically contain autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The malicious payload modifies package.json to remove private flags, changes version numbers, generates random Indonesian-themed package names, and continuously republishes variants to pollute the npm registry.

Source: ossf-package-analysis (9acf66e5c2b724047cb22aaef959072d28363e9045fe14fdb7bca489beab4864)

The OpenSSF Package Analysis project identified 'post-purchase-frontend' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2025-11-10T03:31:05.638023077Z",
            "modified_time": "2025-11-10T03:05:47Z",
            "sha256": "9acf66e5c2b724047cb22aaef959072d28363e9045fe14fdb7bca489beab4864",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2025-11-10T04:41:03.653146497Z",
            "modified_time": "2025-11-10T04:05:19Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2025-11-10T05:09:21.504493933Z",
            "modified_time": "2025-11-10T04:50:00Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "992fc85eb0e4d9ae566970d57d0aed37a9a37bdaa2ed16cb623b134ddb9f77c9",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2025-11-10T05:37:40.139252341Z",
            "modified_time": "2025-11-10T05:10:47Z",
            "sha256": "65a0c61a249aa36e426803cbd791a540d16bb55e355ae73f1bf85b11a27b28fc",
            "source": "ossf-package-analysis",
            "versions": [
                "2.0.0"
            ]
        }
    ]
}

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / post-purchase-frontend

Package

Name: post-purchase-frontend; View open source insights on deps.dev
Purl: pkg:npm/post-purchase-frontend

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.1

2.*

2.0.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/post-purchase-frontend/MAL-2025-49731.json"