MAL-2026-10717

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@onescience/onecode/MAL-2026-10717.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10717
Published
2026-07-16T18:41:22Z
Modified
2026-08-07T13:49:47Z
Summary
Malicious code in @onescience/onecode (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (713bf7fce40e177608dd5145e1662b4efd3da6c1597d9a1aeb15d7715b865205)

The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https://218.90.133.98:4443/onecode_tgz/onecode-/onecode-linux-x64-.tgz, extracts it via tar -xzf, chmods the extracted file to 0o755, hardlinks it into bin/.onecode, and the shipped CLI launcher invokes it. The HTTPS request explicitly sets rejectUnauthorized: false, disabling TLS certificate verification, and no hash or signature check is performed on the downloaded artifact. The download destination is a bare IPv4 address on a non-standard port, not a publisher-owned domain or a recognized release host. The package name and launcher (@onescience/onecode) mirror the unrelated 'opencode' project — env-var fallbacks reference OPENCODE_BIN_PATH and bundled asset directories are named.opencode/session-seed and.opencode/oneskills — while the executable payload is retrieved from an unrelated hardcoded IP endpoint. Anyone controlling that host, or any on-path network attacker (TLS is disabled), can deliver arbitrary code that executes on every installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010746",
            "import_time": "2026-07-16T18:54:02.40266225Z",
            "modified_time": "2026-07-16T18:41:22Z",
            "sha256": "5928c2edb03c7fc9a909b2ff56355dde83cab5e7776512204a35e274120932f5",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607161038"
            ]
        },
        {
            "id": "IN-MAL-2026-010765",
            "import_time": "2026-07-16T18:54:03.515113628Z",
            "modified_time": "2026-07-16T18:44:15Z",
            "sha256": "d334dd52244b44793af06be86dfd8d0de20ea8bb6d28cc1e4016b5fa45432578",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607161710"
            ]
        },
        {
            "id": "IN-MAL-2026-010769",
            "import_time": "2026-07-16T18:54:03.76950404Z",
            "modified_time": "2026-07-16T18:44:51Z",
            "sha256": "fa28860ddf0274e1a39af78373aa118824c4479ef158d166d230de533a1b34d0",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607161139"
            ]
        },
        {
            "id": "IN-MAL-2026-016317",
            "import_time": "2026-08-06T13:09:13.999281191Z",
            "modified_time": "2026-08-06T13:03:21Z",
            "sha256": "20c0ef93b477ae7e528e4a59da63f1cc178fc9395a6d3879c49da64b1c2fbc88",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607231111"
            ]
        },
        {
            "id": "IN-MAL-2026-016286",
            "import_time": "2026-08-06T13:09:10.612374328Z",
            "modified_time": "2026-08-06T12:58:46Z",
            "sha256": "42ed0e0defde1688d2260c590a20648fce6f8708e4648720a50094003be1f837",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041043"
            ]
        },
        {
            "id": "IN-MAL-2026-016325",
            "import_time": "2026-08-06T13:09:14.795639299Z",
            "modified_time": "2026-08-06T13:04:39Z",
            "sha256": "5edf043d9db62c55c8c163b9ec0e52bcb542d52191d1b1ba643ddcbc17ea5df7",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607171833"
            ]
        },
        {
            "id": "IN-MAL-2026-016284",
            "import_time": "2026-08-06T13:09:10.432237823Z",
            "modified_time": "2026-08-06T12:58:27Z",
            "sha256": "020acb54b3ef710c8d3e0085fe571c82105d078129d1a9a050c07a79c2d12d2b",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041614"
            ]
        },
        {
            "id": "IN-MAL-2026-016311",
            "import_time": "2026-08-06T13:09:13.357569069Z",
            "modified_time": "2026-08-06T13:02:26Z",
            "sha256": "0e7ae1c3e4aed6fbc817d72c75ccc2a24c8005ccbf0e4e74fb47de144514b4a7",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607270920"
            ]
        },
        {
            "id": "IN-MAL-2026-016312",
            "import_time": "2026-08-06T13:09:13.452638009Z",
            "modified_time": "2026-08-06T13:02:35Z",
            "sha256": "3b22bb450edcdaba7c3c40098eddae048f245de14c9605783b18652dd917a332",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607271545"
            ]
        },
        {
            "id": "IN-MAL-2026-016305",
            "import_time": "2026-08-06T13:09:12.795143124Z",
            "modified_time": "2026-08-06T13:01:37Z",
            "sha256": "3eda8f4a2aea77f15f7347b8a2e5a0bfdcbd8d7ac5f3a8184a722636ae035bae",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281814"
            ]
        },
        {
            "id": "IN-MAL-2026-016287",
            "import_time": "2026-08-06T13:09:10.701650722Z",
            "modified_time": "2026-08-06T12:58:56Z",
            "sha256": "4bba69b51e2e39542b27438d3a34a29165dd37f02787484dac7068c17be1e6a3",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608031812"
            ]
        },
        {
            "id": "IN-MAL-2026-016308",
            "import_time": "2026-08-06T13:09:13.072029638Z",
            "modified_time": "2026-08-06T13:02:01Z",
            "sha256": "6713a2476cbcfbd9cc2d5f4b299f86e050efa24a0774c4363c36625e6af34c9e",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607271808"
            ]
        },
        {
            "id": "IN-MAL-2026-016306",
            "import_time": "2026-08-06T13:09:12.886552141Z",
            "modified_time": "2026-08-06T13:01:45Z",
            "sha256": "b276b0abc82fba54bbf841318aef59fe1ea855d1a6c2a67f90ee78025f55a026",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281613"
            ]
        },
        {
            "id": "IN-MAL-2026-016298",
            "import_time": "2026-08-06T13:09:12.067617015Z",
            "modified_time": "2026-08-06T13:00:36Z",
            "sha256": "b6c67dfc5ec3dfedc2e04693bb6486f86ab32600c880fcc74103c80fa0578e4a",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607291705"
            ]
        },
        {
            "id": "IN-MAL-2026-016295",
            "import_time": "2026-08-06T13:09:11.779146607Z",
            "modified_time": "2026-08-06T13:00:06Z",
            "sha256": "3782b1d42fbc885c5d6f4549274bb5a8e8d1a1d7b33931b7cbd8d0bcfd502412",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607301758"
            ]
        },
        {
            "id": "IN-MAL-2026-016321",
            "import_time": "2026-08-06T13:09:14.363105545Z",
            "modified_time": "2026-08-06T13:04:01Z",
            "sha256": "3f2c83e27a4d5d8a897030b13d5bf4d2c26b38069e53a2d4d6eeb653dab7db92",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607200911"
            ]
        },
        {
            "id": "IN-MAL-2026-016315",
            "import_time": "2026-08-06T13:09:13.728284331Z",
            "modified_time": "2026-08-06T13:03:02Z",
            "sha256": "5aa68b21d0f3a19c1f5fe2639cc4c9ec77d1a96dc28928a7430ec566e6ab515a",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607231354"
            ]
        },
        {
            "id": "IN-MAL-2026-016319",
            "import_time": "2026-08-06T13:09:14.180533972Z",
            "modified_time": "2026-08-06T13:03:44Z",
            "sha256": "6a058f44e50e02375a01e704b632ec71f65a8f3393c1c5cdbb578dad29a2b0d4",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607221649"
            ]
        },
        {
            "id": "IN-MAL-2026-016289",
            "import_time": "2026-08-06T13:09:11.173687802Z",
            "modified_time": "2026-08-06T12:59:13Z",
            "sha256": "7138306ad2ed4c2181a4c24587c0c78585c31878edf3dba159c592bea4de9da7",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608061753"
            ]
        },
        {
            "id": "IN-MAL-2026-016309",
            "import_time": "2026-08-06T13:09:13.167750543Z",
            "modified_time": "2026-08-06T13:02:08Z",
            "sha256": "8987ef65f2b72c34365038323ea0c61d7a6910c1d7e2ecf819ba7b0b8df7b968",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281527"
            ]
        },
        {
            "id": "IN-MAL-2026-016294",
            "import_time": "2026-08-06T13:09:11.688315662Z",
            "modified_time": "2026-08-06T12:59:58Z",
            "sha256": "e2453ca4f361157f5b95ebbc8e1ea7c8f82d19e54462f5d586dcc75d1b48d5ae",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607311732"
            ]
        },
        {
            "id": "IN-MAL-2026-016303",
            "import_time": "2026-08-06T13:09:12.603916909Z",
            "modified_time": "2026-08-06T13:01:21Z",
            "sha256": "13c3495688857a8750947b85ab9472344dcfb345e48d9f8483baf1f80be38d3e",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281758"
            ]
        },
        {
            "id": "IN-MAL-2026-016291",
            "import_time": "2026-08-06T13:09:11.376510715Z",
            "modified_time": "2026-08-06T12:59:34Z",
            "sha256": "18422bf33af9d1707cd4a95daa05c872bbe3d8fbd2c1b5736af9f4735638069e",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607311756"
            ]
        },
        {
            "id": "IN-MAL-2026-016323",
            "import_time": "2026-08-06T13:09:14.554867222Z",
            "modified_time": "2026-08-06T13:04:22Z",
            "sha256": "406adb8670d5d195ca6298fcad1c5c9184867cb57b1703310977ac7b5231bc9b",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607171841"
            ]
        },
        {
            "id": "IN-MAL-2026-016297",
            "import_time": "2026-08-06T13:09:11.973466078Z",
            "modified_time": "2026-08-06T13:00:23Z",
            "sha256": "45f7fa9c02faf00ae29b29da19e7f240d5b21e2fa7dfced97e8a70c605181f40",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607301600"
            ]
        },
        {
            "id": "IN-MAL-2026-016296",
            "import_time": "2026-08-06T13:09:11.871123066Z",
            "modified_time": "2026-08-06T13:00:14Z",
            "sha256": "4d0a88be7a7751280c18029164ccc2c99a9e6df4c4311f8271fc2d4178b6409b",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607310907"
            ]
        },
        {
            "id": "IN-MAL-2026-016288",
            "import_time": "2026-08-06T13:09:11.071464102Z",
            "modified_time": "2026-08-06T12:59:04Z",
            "sha256": "6901b470b2dd948fcd7dd5adc48e74f849ac2c1277df90ad7ecfc829659efb03",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608010827"
            ]
        },
        {
            "id": "IN-MAL-2026-016285",
            "import_time": "2026-08-06T13:09:10.522705928Z",
            "modified_time": "2026-08-06T12:58:36Z",
            "sha256": "07d42b1f329d1fd0ef3a9c57d0a523103d4b971e02b4ca09dbf87781376a38d5",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041653"
            ]
        },
        {
            "id": "IN-MAL-2026-016300",
            "import_time": "2026-08-06T13:09:12.257862128Z",
            "modified_time": "2026-08-06T13:00:57Z",
            "sha256": "27a4a1b7cd0d13d799c102e83ec8be78455bc444c063d2573c814b076b30f090",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607291116"
            ]
        },
        {
            "id": "IN-MAL-2026-016313",
            "import_time": "2026-08-06T13:09:13.542096484Z",
            "modified_time": "2026-08-06T13:02:44Z",
            "sha256": "5ca3f1516a7b5612db43a5de5c058a553fef967a94c25119939679ba0d727772",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607240916"
            ]
        },
        {
            "id": "IN-MAL-2026-016318",
            "import_time": "2026-08-06T13:09:14.087925233Z",
            "modified_time": "2026-08-06T13:03:33Z",
            "sha256": "f81b171c3e580edcfac82fe2cdc5db611735f4c47ccef8a131e2941ae2d5d8ce",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607230908"
            ]
        },
        {
            "id": "IN-MAL-2026-016320",
            "import_time": "2026-08-06T13:09:14.270725511Z",
            "modified_time": "2026-08-06T13:03:52Z",
            "sha256": "fea78f743ba6e4f88317b38be3b51a2c9f4c9a092bd4355dca76a960c5c81c63",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607201741"
            ]
        },
        {
            "id": "IN-MAL-2026-016327",
            "import_time": "2026-08-06T13:09:15.009164343Z",
            "modified_time": "2026-08-06T13:04:56Z",
            "sha256": "0e4999b5f60515ed2433bd2ace50d69d2c17246b859e615e6736c947f1ecc122",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607161642"
            ]
        },
        {
            "id": "IN-MAL-2026-016280",
            "import_time": "2026-08-06T13:09:09.908934726Z",
            "modified_time": "2026-08-06T12:57:54Z",
            "sha256": "37bf72a75a7b01d9770282d4addd8adf5fa1ad2f180984f1494c46f1df61214f",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041828"
            ]
        },
        {
            "id": "IN-MAL-2026-016293",
            "import_time": "2026-08-06T13:09:11.591744096Z",
            "modified_time": "2026-08-06T12:59:49Z",
            "sha256": "52d195c78fae104cb20948b948c3fce1429a8c7181290eb608e14b8cb501e63a",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041416"
            ]
        },
        {
            "id": "IN-MAL-2026-016307",
            "import_time": "2026-08-06T13:09:12.981942143Z",
            "modified_time": "2026-08-06T13:01:53Z",
            "sha256": "644160ed0c64e0f0d2c7521a081a6f85904cacf0df5883aa1fc64505d6b100f2",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281737"
            ]
        },
        {
            "id": "IN-MAL-2026-016278",
            "import_time": "2026-08-06T13:09:09.690846518Z",
            "modified_time": "2026-08-06T12:57:39Z",
            "sha256": "713bf7fce40e177608dd5145e1662b4efd3da6c1597d9a1aeb15d7715b865205",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608051418"
            ]
        },
        {
            "id": "IN-MAL-2026-016314",
            "import_time": "2026-08-06T13:09:13.633964104Z",
            "modified_time": "2026-08-06T13:02:54Z",
            "sha256": "b9030ee9b873d47b25e221c2a12659ac8d7f28fd6f620fd118981d4c3b5b4158",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607231515"
            ]
        },
        {
            "id": "IN-MAL-2026-016322",
            "import_time": "2026-08-06T13:09:14.458942445Z",
            "modified_time": "2026-08-06T13:04:10Z",
            "sha256": "f928ad8157770e106ddae70411f88b51b5b7df3b2f8c29c6f0a5df35ad8925f3",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607220956"
            ]
        },
        {
            "id": "IN-MAL-2026-016310",
            "import_time": "2026-08-06T13:09:13.264708897Z",
            "modified_time": "2026-08-06T13:02:19Z",
            "sha256": "32f21903ba7f36c95db3b5d232c7a611add99ef606aa0f254778b6f07602fed4",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607271456"
            ]
        },
        {
            "id": "IN-MAL-2026-016290",
            "import_time": "2026-08-06T13:09:11.266395489Z",
            "modified_time": "2026-08-06T12:59:21Z",
            "sha256": "33117e2d408ed451c4a4322585a33518a7e60d2f161149ac6bb34f957af36b4d",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608031514"
            ]
        },
        {
            "id": "IN-MAL-2026-016292",
            "import_time": "2026-08-06T13:09:11.466285695Z",
            "modified_time": "2026-08-06T12:59:41Z",
            "sha256": "353bf9f994768a380ea1e3d1df3abe1cd9c5bb95b6edd46ee046673f0837c9de",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607311449"
            ]
        },
        {
            "id": "IN-MAL-2026-016299",
            "import_time": "2026-08-06T13:09:12.159660813Z",
            "modified_time": "2026-08-06T13:00:44Z",
            "sha256": "37bcc48cacbe1078c0a156a03aa38801038fa24a1ab45a2cd1deaa5a75b119b8",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607291417"
            ]
        },
        {
            "id": "IN-MAL-2026-016301",
            "import_time": "2026-08-06T13:09:12.41244318Z",
            "modified_time": "2026-08-06T13:01:03Z",
            "sha256": "48dab1d91e605222b7b48cc4c368944832584c12e86c7f0e37d8aa9386a074f6",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281928"
            ]
        },
        {
            "id": "IN-MAL-2026-016316",
            "import_time": "2026-08-06T13:09:13.881010861Z",
            "modified_time": "2026-08-06T13:03:13Z",
            "sha256": "4b1c06b0b5671ba7ea9062ac239f5f0e3d569df7fbf2f45fa25b2d4b27c9d208",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607231344"
            ]
        },
        {
            "id": "IN-MAL-2026-016304",
            "import_time": "2026-08-06T13:09:12.698288792Z",
            "modified_time": "2026-08-06T13:01:28Z",
            "sha256": "b3761ce1f0e4ecf6893d900c9d91e50650f79f56a79398549892b21c112b04c5",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607281838"
            ]
        },
        {
            "id": "IN-MAL-2026-016281",
            "import_time": "2026-08-06T13:09:09.99436484Z",
            "modified_time": "2026-08-06T12:58:03Z",
            "sha256": "bed46c93dbc131361e9bee5c3670dd0a795ffe64fb2ec821c14d1432eede3b45",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608061459"
            ]
        },
        {
            "id": "IN-MAL-2026-016283",
            "import_time": "2026-08-06T13:09:10.17135366Z",
            "modified_time": "2026-08-06T12:58:19Z",
            "sha256": "155921e76e3d1f3bfe82f3afa2805e7afb79dc6b76371d315411ba216665e224",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041802"
            ]
        },
        {
            "id": "IN-MAL-2026-016279",
            "import_time": "2026-08-06T13:09:09.823214928Z",
            "modified_time": "2026-08-06T12:57:46Z",
            "sha256": "256653c31ab504ff60976c2c7429877bff1e85818d26dd7a55b21c65bef03a47",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608051826"
            ]
        },
        {
            "id": "IN-MAL-2026-016282",
            "import_time": "2026-08-06T13:09:10.088233421Z",
            "modified_time": "2026-08-06T12:58:12Z",
            "sha256": "74ec1bab45a6b596094479cdb58a46f0d557876a0fbf916644c4eef4d11eca2f",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608041724"
            ]
        },
        {
            "id": "IN-MAL-2026-016302",
            "import_time": "2026-08-06T13:09:12.508503527Z",
            "modified_time": "2026-08-06T13:01:10Z",
            "sha256": "fcef18ee955f353cc3bdaeae6276cb5547ff145772d5e75ba38ba23538257b44",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202607291013"
            ]
        },
        {
            "id": "IN-MAL-2026-017065",
            "import_time": "2026-08-07T12:51:24.650954568Z",
            "modified_time": "2026-08-07T12:47:33Z",
            "sha256": "76f4efc2e5d92f5066291ba5e97f5f3dee1e273105996405dcc3f98dda95d13e",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608071618"
            ]
        },
        {
            "id": "IN-MAL-2026-017076",
            "import_time": "2026-08-07T13:32:44.078518052Z",
            "modified_time": "2026-08-07T12:53:54Z",
            "sha256": "2cbf23de79fca78ffe5a4f81840208deda5b6e14d3cef5c6a694ffd66b17dfa4",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608071143"
            ]
        },
        {
            "id": "IN-MAL-2026-017075",
            "import_time": "2026-08-07T13:32:44.038622868Z",
            "modified_time": "2026-08-07T12:53:43Z",
            "sha256": "d14bea8230d267d016863789ffdda363c0aaf9711e5224c6b4741d1c53e46ad3",
            "source": "amazon-inspector",
            "versions": [
                "1.14.50-202608070922"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @onescience/onecode

Package

Name
@onescience/onecode
View open source insights on deps.dev
Purl
pkg:npm/%40onescience/onecode

Affected ranges

Affected versions

1.*
1.14.50-202607161038
1.14.50-202607161139
1.14.50-202607161642
1.14.50-202607161710
1.14.50-202607171833
1.14.50-202607171841
1.14.50-202607200911
1.14.50-202607201741
1.14.50-202607220956
1.14.50-202607221649
1.14.50-202607230908
1.14.50-202607231111
1.14.50-202607231344
1.14.50-202607231354
1.14.50-202607231515
1.14.50-202607240916
1.14.50-202607270920
1.14.50-202607271456
1.14.50-202607271545
1.14.50-202607271808
1.14.50-202607281527
1.14.50-202607281613
1.14.50-202607281737
1.14.50-202607281758
1.14.50-202607281814
1.14.50-202607281838
1.14.50-202607281928
1.14.50-202607291013
1.14.50-202607291116
1.14.50-202607291417
1.14.50-202607291705
1.14.50-202607301600
1.14.50-202607301758
1.14.50-202607310907
1.14.50-202607311449
1.14.50-202607311732
1.14.50-202607311756
1.14.50-202608010827
1.14.50-202608031514
1.14.50-202608031812
1.14.50-202608041043
1.14.50-202608041416
1.14.50-202608041614
1.14.50-202608041653
1.14.50-202608041724
1.14.50-202608041802
1.14.50-202608041828
1.14.50-202608051418
1.14.50-202608051826
1.14.50-202608061459
1.14.50-202608061753
1.14.50-202608070922
1.14.50-202608071143
1.14.50-202608071618

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "platform-bootstrap.mjs",
            "sha256": "0795feaceb78b42d123dafb190444f534ea5e51c920775aaafe3ee2cee0acf47",
            "tlsh": "ad02448657f143b08ba166ea225b7514a63991123e0fad9cfadc47d43b61128e3837fc"
        }
    ],
    "package_integrity": [
        {
            "filename": "onecode-1.14.50-202607161038.tgz",
            "hashes": {
                "sha1": "207b6685273c80f29e0bccca3875606db194ecb7",
                "sha512_sri": "sha512-9SEdFnEwYTTvxyrmzYfxkd/eRKR4N/I1wZQfF+5ML0Sp8Q8IG3WyUVvhQEnYFu/wlESEbWAqOza9CexzYpCQzg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@onescience/onecode/MAL-2026-10717.json"