MAL-2026-1704

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/date-fns-scripts/MAL-2026-1704.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-1704
Published
2026-03-18T12:46:05Z
Modified
2026-03-23T05:41:27.485845Z
Summary
Malicious code in date-fns-scripts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ae8c5ce8aaa40b0479646a8cd09a5a83b803e857a64de372621002edcb2e27cd)

The package date-fns-scripts was found to contain malicious code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "reversing-labs",
            "id": "RLMA-2026-01235",
            "versions": [
                "9.9.9"
            ],
            "import_time": "2026-03-19T12:18:44.545492613Z",
            "modified_time": "2026-03-18T12:46:05Z",
            "sha256": "8309ccd5b3042f3421995fd117f188caac3241a1b7f4dd59215c9b6dd7d40e9e"
        },
        {
            "source": "amazon-inspector",
            "versions": [
                "9.9.9"
            ],
            "import_time": "2026-03-23T05:14:42.686280002Z",
            "modified_time": "2026-03-23T05:11:41Z",
            "sha256": "ae8c5ce8aaa40b0479646a8cd09a5a83b803e857a64de372621002edcb2e27cd"
        }
    ]
}
References
Credits

Affected packages

npm / date-fns-scripts

Package

Name
date-fns-scripts
View open source insights on deps.dev
Purl
pkg:npm/date-fns-scripts

Affected ranges

Affected versions

9.*
9.9.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/date-fns-scripts/MAL-2026-1704.json"