MAL-2026-2492

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/admin0911/MAL-2026-2492.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2492

Aliases

GHSA-hr5g-wqxg-m42m

Published

2026-04-05T15:30:57Z

Modified

2026-04-14T01:21:30.563172Z

Summary

Malicious code in admin0911 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (131de816e8ec55ce8cba8760646cd38392aa5d5c64d74ca83d6331ce81dc92c7)

The package admin0911 was found to contain malicious code.

Source: ghsa-malware (3b8dd74b10ddf8f43854df0999878fec4cffe7ec1e4d42e136602be00468a54c)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source: ossf-package-analysis (8516309c67b62cd05a8cec44d5bd7cb5ebceebd331c870e3589ab027bb926bb7)

The OpenSSF Package Analysis project identified 'admin0911' @ 1.0.38 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-04-05T15:44:59.807607857Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ],
            "modified_time": "2026-04-05T15:43:43Z",
            "sha256": "3695d0f7489e83b4ec745cea51d9a057efc6c22f3f7a4b2fb6e640527d8343a4"
        },
        {
            "import_time": "2026-04-05T15:44:59.662404516Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2026-04-05T15:30:57Z",
            "sha256": "5c85e038183d5abde236e2f52464a662b6aed5f6129c6ad6a568ec565c361f89"
        },
        {
            "import_time": "2026-04-05T15:44:59.753649986Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.2"
            ],
            "modified_time": "2026-04-05T15:39:31Z",
            "sha256": "e18d7245ffba525783ef5adcf4e1139bbab811212ba167258d6b1c41462a3356"
        },
        {
            "import_time": "2026-04-05T16:12:37.953107833Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.5"
            ],
            "modified_time": "2026-04-05T16:10:09Z",
            "sha256": "5400638b8f302ba0dcdf7fe2ef807b7d914e1402f7c26109b3b68e2b46af7ffd"
        },
        {
            "import_time": "2026-04-05T16:12:37.901744722Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.4"
            ],
            "modified_time": "2026-04-05T15:55:48Z",
            "sha256": "26fac17d4076abe58d460e1e9ceaedeec2f6ba9e3daaaf1920dd84caa638a32e"
        },
        {
            "import_time": "2026-04-05T17:12:27.682975085Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.8"
            ],
            "modified_time": "2026-04-05T16:55:37Z",
            "sha256": "cf656bb5a4d98071f7a8ab56f208cd3700efe87a7325c344eb379d8e87d8e139"
        },
        {
            "import_time": "2026-04-05T17:45:11.355907433Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.12"
            ],
            "modified_time": "2026-04-05T17:34:39Z",
            "sha256": "428a4a04a4930c8c8d9b430fb7a3ffcff1dd4cd2cbf63727ccaf9d3c8de48936"
        },
        {
            "import_time": "2026-04-05T17:45:11.274943083Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.11"
            ],
            "modified_time": "2026-04-05T17:32:00Z",
            "sha256": "382bdef35e36a5feec0cad981c76915cb8f875d01626bd3395bedb729e9b0486"
        },
        {
            "import_time": "2026-04-05T18:14:53.614474406Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.10"
            ],
            "modified_time": "2026-04-05T17:46:16Z",
            "sha256": "e5e4e1fc75301ca7250ef6fced097b98d827424f1df7f2ef4a1dfe0405ec39f0"
        },
        {
            "import_time": "2026-04-05T18:48:11.019127717Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.14"
            ],
            "modified_time": "2026-04-05T18:38:39Z",
            "sha256": "09f24ddbbcc8473b6871c3da3e69e669df9b7f643bfac2dd4b582e5962c4eecd"
        },
        {
            "import_time": "2026-04-05T18:48:10.851779219Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.13"
            ],
            "modified_time": "2026-04-05T18:35:52Z",
            "sha256": "4faf70dade9278166dd051dda6a1a3c8bf87c810b0d206830f118dedf2ba3448"
        },
        {
            "import_time": "2026-04-06T16:20:23.93956787Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.21"
            ],
            "modified_time": "2026-04-06T16:15:38Z",
            "sha256": "cfc467e110572f449912dbc6e27e5cdb26fbe049b8c6dd378f5c4ae7e41b156f"
        },
        {
            "import_time": "2026-04-06T16:20:23.78682334Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.19"
            ],
            "modified_time": "2026-04-06T15:55:45Z",
            "sha256": "00544f3a87422e5d3722f08a03550e56980362172bfbe064a478724f4c50e39d"
        },
        {
            "import_time": "2026-04-06T16:48:17.812333238Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.23"
            ],
            "modified_time": "2026-04-06T16:25:44Z",
            "sha256": "7ba859281540df54fdbc16e0fb345bcdd8992096d3aba54aa31c6968a71f421c"
        },
        {
            "import_time": "2026-04-06T19:49:55.614332754Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.38"
            ],
            "modified_time": "2026-04-06T19:40:56Z",
            "sha256": "8516309c67b62cd05a8cec44d5bd7cb5ebceebd331c870e3589ab027bb926bb7"
        },
        {
            "import_time": "2026-04-06T20:17:05.724520146Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.39"
            ],
            "modified_time": "2026-04-06T19:52:43Z",
            "sha256": "0f0a6fce857d51342c57c185f8d059dbad9c04f410521bd2a0c555811b57a82c"
        },
        {
            "import_time": "2026-04-06T20:17:05.575367119Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.37"
            ],
            "modified_time": "2026-04-06T19:52:32Z",
            "sha256": "f5929b05d89b9d44dc61f8bb1a60a40fa66f3e6d6fa09ce845562163ffd251d2"
        },
        {
            "import_time": "2026-04-06T21:15:54.772352014Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.44"
            ],
            "modified_time": "2026-04-06T21:11:36Z",
            "sha256": "a5026e814264c4520bc542d2cfe990af525e6724c2cc684ebadb95dabd1242a3"
        },
        {
            "import_time": "2026-04-06T21:46:41.302491648Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.47"
            ],
            "modified_time": "2026-04-06T21:26:19Z",
            "sha256": "2b03020b2462366f58fbcae62d80fa2e2ac7b312dac3ebf57fd59ab7b0c4a4a7"
        },
        {
            "import_time": "2026-04-06T21:46:41.343937952Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.48"
            ],
            "modified_time": "2026-04-06T21:30:48Z",
            "sha256": "7820c18fe358cd7a14d30da3040d1ba0ca02a2189f4fe1f84a98b9636fac5464"
        },
        {
            "import_time": "2026-04-06T21:46:41.226726765Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.45"
            ],
            "modified_time": "2026-04-06T21:16:33Z",
            "sha256": "a76584e7e264e71950f5170fe4470e06e8ad48398335fe58a5e5523f1f33abcf"
        },
        {
            "import_time": "2026-04-06T21:46:41.410027975Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.43"
            ],
            "modified_time": "2026-04-06T21:37:38Z",
            "sha256": "a9d3d2e1466512fccf2f526bcfc8f57f1aa0bf474431bf633d8f65d1e6c2fad2"
        },
        {
            "import_time": "2026-04-06T22:13:27.449644414Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.51"
            ],
            "modified_time": "2026-04-06T22:07:37Z",
            "sha256": "04c5b0bd097bb02ad2646265eed64a5915e7c84af6f44e3c0bf3fceac6ec8e3d"
        },
        {
            "import_time": "2026-04-06T22:13:27.350071751Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.52"
            ],
            "modified_time": "2026-04-06T22:06:41Z",
            "sha256": "1961aefe764eaa2339491f5bbba0bce6623f9039f47930540e7a52c93a3162ff"
        },
        {
            "import_time": "2026-04-06T22:13:27.252861072Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.49"
            ],
            "modified_time": "2026-04-06T21:50:52Z",
            "sha256": "8c2e9219becf1d5a997b4166889751cf6da7737d9661e25516aa7b9a4afece74"
        },
        {
            "import_time": "2026-04-06T22:46:57.770537922Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.55"
            ],
            "modified_time": "2026-04-06T22:18:24Z",
            "sha256": "30b4145d46778b93d12881e8d0d99fc6c0f021ce12a68bde4ba924ad125284db"
        },
        {
            "import_time": "2026-04-06T22:46:57.843281364Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.56"
            ],
            "modified_time": "2026-04-06T22:27:55Z",
            "sha256": "c7229e750b5648710bbf20e1aa91f887cc53234fcec80679463d6731781a1885"
        },
        {
            "import_time": "2026-04-06T22:46:57.705418555Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.54"
            ],
            "modified_time": "2026-04-06T22:17:22Z",
            "sha256": "f20770c413b0edb94ebd3197340b57096ece2c44821a5546aa6e13dbb57ba09e"
        },
        {
            "import_time": "2026-04-06T23:15:35.847481468Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.62"
            ],
            "modified_time": "2026-04-06T23:07:13Z",
            "sha256": "01a2c86b50650bff2c33907d686fe824f4b4afd4b33e95885bb118ac00e5cfb3"
        },
        {
            "import_time": "2026-04-06T23:15:35.703939527Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.61"
            ],
            "modified_time": "2026-04-06T23:06:42Z",
            "sha256": "b7d8ba2a640c047ff3933948e8e50322a6ccf3afb05e27acb64137bbeb064584"
        },
        {
            "import_time": "2026-04-06T23:15:35.518361188Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.60"
            ],
            "modified_time": "2026-04-06T23:01:08Z",
            "sha256": "d631267d1bceb36cb2e6dad1e41ebb630184de67466e5ceef0fbe6cb4291237f"
        },
        {
            "import_time": "2026-04-06T23:46:45.445054659Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.64"
            ],
            "modified_time": "2026-04-06T23:24:06Z",
            "sha256": "0811ed207df49a8b2f03fb524ad90d2a754df67f180eb7f78568ea1bffecb9f9"
        },
        {
            "import_time": "2026-04-06T23:46:45.354391299Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.63"
            ],
            "modified_time": "2026-04-06T23:17:23Z",
            "sha256": "f59c404d5fd3cff9daa12f668fa89a19d33b8f4d6a8cab9a3db25695a0a79cfb"
        },
        {
            "import_time": "2026-04-07T09:30:03.215595652Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.66"
            ],
            "modified_time": "2026-04-07T09:10:44Z",
            "sha256": "fc2dade7a4c6d70d4a224ca05fa9b464906bcd023bf0a1e7f42e47f1a2f56274"
        },
        {
            "import_time": "2026-04-07T14:39:18.585439066Z",
            "source": "amazon-inspector",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "modified_time": "2026-04-07T14:24:50Z",
            "sha256": "131de816e8ec55ce8cba8760646cd38392aa5d5c64d74ca83d6331ce81dc92c7"
        },
        {
            "import_time": "2026-04-08T10:51:12.702886811Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.74"
            ],
            "modified_time": "2026-04-08T10:41:04Z",
            "sha256": "915fbcb00a56736c74fd6bac9150fe0fd41d5176bffcc38ff24e89a3dad105c5"
        },
        {
            "import_time": "2026-04-08T10:51:12.636576713Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.75"
            ],
            "modified_time": "2026-04-08T10:36:03Z",
            "sha256": "c9038d6011ae0e0704c830183ab305f1b18b2ea56a7372db1c65e41b3d358e0a"
        },
        {
            "import_time": "2026-04-08T12:26:00.507291617Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.80"
            ],
            "modified_time": "2026-04-08T12:06:11Z",
            "sha256": "c93f607fb900cc4883f10c39a80a488d8ee0ee91305b619c5f14a09ccd251276"
        },
        {
            "import_time": "2026-04-08T12:26:00.129918273Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.78"
            ],
            "modified_time": "2026-04-08T11:55:50Z",
            "sha256": "f44a219b0e66b00d33cd176741bf0b22e176e9334dbb7bc1b1714e638cca5b14"
        },
        {
            "import_time": "2026-04-08T12:26:00.328822392Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.79"
            ],
            "modified_time": "2026-04-08T12:01:16Z",
            "sha256": "bbc1f5ffdcb27f45f5932ec7fe96058c094d2fcf2f53fbe2d6fc131c53ea8882"
        },
        {
            "import_time": "2026-04-08T13:36:42.582632914Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.88"
            ],
            "modified_time": "2026-04-08T13:11:01Z",
            "sha256": "6519e53b2233beaf25d2936c670a37dde7a5004cfde5d27953e725f0c5311500"
        },
        {
            "import_time": "2026-04-08T13:36:42.488561907Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.85"
            ],
            "modified_time": "2026-04-08T13:00:55Z",
            "sha256": "8174f37f4557d0d978418276ca1b5ed0146a698dd4a3dc67e5a00962d0984e30"
        },
        {
            "import_time": "2026-04-08T13:36:42.704763451Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.93"
            ],
            "modified_time": "2026-04-08T13:33:47Z",
            "sha256": "fdbe85ca32b4a6ac18bf5b64e20aec8ab349cec3035d2c5a7a53dd6d44da46db"
        },
        {
            "import_time": "2026-04-08T14:39:13.787593049Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.91"
            ],
            "modified_time": "2026-04-08T14:34:40Z",
            "sha256": "c46732b638c390a0bcfb18114db829b60516a437a9766e5b6b12f3bc6328326e"
        },
        {
            "import_time": "2026-04-08T15:34:41.213955734Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.95"
            ],
            "modified_time": "2026-04-08T15:15:26Z",
            "sha256": "80e723d28b01c54b7f50d22e719adb9cd9ebccc35fd1bd6c0d23d1e47de9d7dc"
        },
        {
            "import_time": "2026-04-08T17:54:23.66810672Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.100"
            ],
            "modified_time": "2026-04-08T17:44:09Z",
            "sha256": "645de188738e4aa5552dbd60c7fe46dd0d986bac224eeae86d938bbde79b8984"
        },
        {
            "import_time": "2026-04-08T17:54:23.820981597Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.1.0"
            ],
            "modified_time": "2026-04-08T17:45:54Z",
            "sha256": "ddf5c15949ca3d2a7d133980e825056903bb01428c224b084842d0a340bb11e7"
        },
        {
            "import_time": "2026-04-08T18:32:27.106996076Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.1.2"
            ],
            "modified_time": "2026-04-08T18:01:19Z",
            "sha256": "5dc35261486a79b970a497afe7859ad6f18c41203df98841454f6ef218bb54f3"
        },
        {
            "import_time": "2026-04-14T01:03:35.903298491Z",
            "id": "GHSA-hr5g-wqxg-m42m",
            "source": "ghsa-malware",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "modified_time": "2026-04-14T00:00:57Z",
            "sha256": "3b8dd74b10ddf8f43854df0999878fec4cffe7ec1e4d42e136602be00468a54c"
        }
    ]
}

References

https://github.com/advisories/GHSA-hr5g-wqxg-m42m

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / admin0911

Package

Name: admin0911; View open source insights on deps.dev
Purl: pkg:npm/admin0911

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.4

1.0.5

1.0.8

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.19

1.0.21

1.0.23

1.0.37

1.0.38

1.0.39

1.0.43

1.0.44

1.0.45

1.0.47

1.0.48

1.0.49

1.0.51

1.0.52

1.0.54

1.0.55

1.0.56

1.0.60

1.0.61

1.0.62

1.0.63

1.0.64

1.0.66

1.0.74

1.0.75

1.0.78

1.0.79

1.0.80

1.0.85

1.0.88

1.0.91

1.0.93

1.0.95

1.0.100

1.1.0

1.1.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/admin0911/MAL-2026-2492.json"

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]