MAL-2026-13412

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apicity/meta/MAL-2026-13412.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13412
Published
2026-08-06T13:10:14Z
Modified
2026-08-07T13:20:09.878268840Z
Summary
Malicious code in @apicity/meta (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581)

dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload host in the TanStack/Shai-Hulud npm supply-chain compromise campaign. Anonymous ephemeral file hosts have no legitimate role in a published npm package's runtime code; their appearance matches the known-bad-infrastructure-dropper fingerprint where installer-side code fetches and executes attacker-controlled bytes from a host that cannot be pinned or verified. The package is scoped and shipped as a distributable, so consumers installing or loading @apicity/meta are exposed to whatever content is served from that host at the moment the reference is resolved.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T13:10:14Z",
            "import_time": "2026-08-06T14:19:45.21950783Z",
            "sha256": "131cbb214b98f8307745eff526b3f512ac27dc6743a2873b3fb2fdd9b6e701d0",
            "source": "amazon-inspector",
            "versions": [
                "0.8.5"
            ],
            "id": "IN-MAL-2026-016362"
        },
        {
            "modified_time": "2026-08-06T13:38:53Z",
            "versions": [
                "0.8.2"
            ],
            "sha256": "19edd2e49211988ff76221e8fae2f54ea48ecce93f53111d6a4b3f178f670fb8",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016482",
            "import_time": "2026-08-06T14:19:51.623279442Z"
        },
        {
            "modified_time": "2026-08-06T13:38:36Z",
            "versions": [
                "0.8.1"
            ],
            "sha256": "348fc3474cf19bb88ef64fc7990865145cc84c86664c18b08b47b3f6cf7da76a",
            "source": "amazon-inspector",
            "import_time": "2026-08-06T14:19:51.553867071Z",
            "id": "IN-MAL-2026-016480"
        },
        {
            "modified_time": "2026-08-06T13:39:27Z",
            "versions": [
                "0.8.3"
            ],
            "sha256": "9e3b6925f0e0152943fd0e6b4950113ce42c0ab48dd0d643ad60606ae9785c52",
            "source": "amazon-inspector",
            "import_time": "2026-08-06T14:19:51.836133704Z",
            "id": "IN-MAL-2026-016486"
        },
        {
            "modified_time": "2026-08-06T13:38:01Z",
            "versions": [
                "0.8.0"
            ],
            "sha256": "a748f9ca8e1731ba7c7c2d3a2f7643fd290f090fc118e65a8cec086cc8d51583",
            "source": "amazon-inspector",
            "import_time": "2026-08-06T14:19:51.356413815Z",
            "id": "IN-MAL-2026-016476"
        },
        {
            "modified_time": "2026-08-06T13:38:46Z",
            "versions": [
                "0.8.6"
            ],
            "sha256": "c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016481",
            "import_time": "2026-08-06T14:19:51.587152418Z"
        },
        {
            "modified_time": "2026-08-06T13:39:03Z",
            "versions": [
                "0.8.4"
            ],
            "sha256": "df97618d24d1223f42ce4837e8ad5df36e7ea97d458c54fdf1a242d72423e8d9",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016483",
            "import_time": "2026-08-06T14:19:51.702221412Z"
        },
        {
            "modified_time": "2026-08-07T12:40:21Z",
            "id": "IN-MAL-2026-017062",
            "sha256": "c0c9f65af9eff5ef8d307d7a9c462525cb4be16da773d1157ba74008f62e7893",
            "source": "amazon-inspector",
            "import_time": "2026-08-07T12:51:24.562669055Z",
            "versions": [
                "0.8.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @apicity/meta

Package

Name
@apicity/meta
View open source insights on deps.dev
Purl
pkg:npm/%40apicity/meta

Affected ranges

Affected versions

0.*
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.8

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apicity/meta/MAL-2026-13412.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "0271e19599f34026066b94bc568f5416e279d4073048ed0c3f8dc3acaf5a87d4ba3bde",
            "path": "dist/src/example.js",
            "sha256": "21c7721228ffa5c5bc685cab4fd6bc421971390f236bcf0fdd0662b9a8598f00"
        }
    ],
    "package_integrity": [
        {
            "filename": "meta-0.8.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-hhdIDoJa9K1goWFXxHTKDJwE7ZqdTMrP83pUnyde44YT/4/OlutsbeP4Z67lPjrQiIuU6UzmsmKxssLU8S7f5A==",
                "sha1": "cb142b17e43b8d3055aa532d5f9b2554fa30f43c"
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]