MAL-2026-2851

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@indriver-poc/whisperwind/MAL-2026-2851.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2851
Published
2026-04-17T18:36:01Z
Modified
2026-04-23T21:09:59.714458Z
Summary
Malicious code in @indriver-poc/whisperwind (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7543a4315d192afe241577899d5777567678b591c400103ba3da0dc46f1b1d55)

The package @indriver-poc/whisperwind was found to contain malicious code.

Source: ossf-package-analysis (904b1f6ef1ac1b7f0087f9da1e1fd121bfcb983caedad382c4b48adfd2b3dec7)

The OpenSSF Package Analysis project identified '@indriver-poc/whisperwind' @ 0.9.5 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.9.5"
            ],
            "import_time": "2026-04-17T18:49:33.770021206Z",
            "modified_time": "2026-04-17T18:36:01Z",
            "sha256": "904b1f6ef1ac1b7f0087f9da1e1fd121bfcb983caedad382c4b48adfd2b3dec7",
            "source": "ossf-package-analysis"
        },
        {
            "versions": [
                "0.9.5"
            ],
            "import_time": "2026-04-23T20:49:11.737348146Z",
            "modified_time": "2026-04-23T20:43:56Z",
            "sha256": "7543a4315d192afe241577899d5777567678b591c400103ba3da0dc46f1b1d55",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @indriver-poc/whisperwind

Package

Name
@indriver-poc/whisperwind
View open source insights on deps.dev
Purl
pkg:npm/%40indriver-poc/whisperwind

Affected ranges

Affected versions

0.*
0.9.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@indriver-poc/whisperwind/MAL-2026-2851.json"