MAL-2026-1666

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/carbon-mac-copy-cloner/MAL-2026-1666.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-1666

Published

2026-03-18T12:41:53Z

Modified

2026-04-16T15:53:05.116863Z

Summary

Malicious code in carbon-mac-copy-cloner (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a38d75b9f18088f693edfe80cca42e9c3688457b43560fa568b6f547b9f464c5)

The package carbon-mac-copy-cloner was found to contain malicious code.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-01138",
            "import_time": "2026-03-19T12:18:35.756437367Z",
            "sha256": "6dc10e5a9da8538054e84562f967ff14ffcb99ee93aebe555a91d0a95e5e7942",
            "source": "reversing-labs",
            "modified_time": "2026-03-18T12:41:53Z",
            "versions": [
                "1.1.0",
                "1.1.1",
                "1.1.2",
                "1.1.3",
                "1.1.4",
                "1.1.5",
                "1.1.6",
                "1.1.7",
                "1.1.8",
                "1.1.9",
                "1.1.10",
                "1.2.1"
            ]
        },
        {
            "import_time": "2026-03-23T05:14:37.371734079Z",
            "sha256": "a38d75b9f18088f693edfe80cca42e9c3688457b43560fa568b6f547b9f464c5",
            "source": "amazon-inspector",
            "modified_time": "2026-03-23T05:11:41Z",
            "versions": [
                "1.1.0",
                "1.1.1",
                "1.1.2",
                "1.1.3",
                "1.1.4",
                "1.1.5",
                "1.1.6",
                "1.1.7",
                "1.1.8",
                "1.1.9",
                "1.1.10",
                "1.2.1"
            ]
        },
        {
            "id": "RLUA-2026-01906",
            "import_time": "2026-04-16T15:39:26.551066251Z",
            "sha256": "1287ed0a0d9b2f4b5fd028c26a7b821290b6d5371ba1cc4e12e7cbac16de1851",
            "source": "reversing-labs",
            "modified_time": "2026-04-16T09:48:08Z"
        }
    ]
}

References

https://www.reversinglabs.com/blog/npm-fake-install-logs-rat

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / carbon-mac-copy-cloner

Package

Name: carbon-mac-copy-cloner; View open source insights on deps.dev
Purl: pkg:npm/carbon-mac-copy-cloner

Affected ranges

Affected versions

1.*

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.2.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/carbon-mac-copy-cloner/MAL-2026-1666.json"