MAL-2025-6927

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-config-i18n-scan/MAL-2025-6927.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-6927
Published
2025-08-17T16:25:41Z
Modified
2025-08-18T06:10:43Z
Summary
Malicious code in eslint-config-i18n-scan (npm)
Details

The package communicates with a domain associated with malicious activity.

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (201f83a69c354c3a004e8b9fd7a778bba4540bc35b88fe6eeaac043b0d6dcd18)

The OpenSSF Package Analysis project identified 'eslint-config-i18n-scan' @ 10.0.2 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-08-18T06:09:47.186273495Z",
            "sha256": "201f83a69c354c3a004e8b9fd7a778bba4540bc35b88fe6eeaac043b0d6dcd18",
            "modified_time": "2025-08-17T16:25:41Z",
            "versions": [
                "10.0.2"
            ],
            "source": "ossf-package-analysis"
        },
        {
            "import_time": "2025-08-18T06:09:47.286608202Z",
            "sha256": "a9253ca9b5e880f358ff4eb8bf5d2a2a4f5facd34bb1321bc83c06c73b53c23e",
            "modified_time": "2025-08-17T16:32:32Z",
            "versions": [
                "11.0.3"
            ],
            "source": "ossf-package-analysis"
        }
    ]
}
References
Credits

Affected packages

npm / eslint-config-i18n-scan

Package

Name
eslint-config-i18n-scan
View open source insights on deps.dev
Purl
pkg:npm/eslint-config-i18n-scan

Affected ranges

Type
SEMVER
Events
Introduced
10.0.1

Affected versions

10.*
10.0.2
11.*
11.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-config-i18n-scan/MAL-2025-6927.json"