MAL-2026-3399

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/money-badger-open-rpc-test-bugbount/MAL-2026-3399.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-3399

Published

2026-05-08T18:05:43Z

Modified

2026-05-12T07:57:12.782749Z

Summary

Malicious code in money-badger-open-rpc-test-bugbount (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (35c3ecacb08f3cfb0b165eadaafd3a0d6acfffc34898a6149370c8cc9ba3843e)

The package money-badger-open-rpc-test-bugbount was found to contain malicious code.

Source: ossf-package-analysis (72bed005637ce1e176a91f2823967cf51bd6922b80c71343d65da7097f6fabbe)

The OpenSSF Package Analysis project identified 'money-badger-open-rpc-test-bugbount' @ 201.99.100 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-08T18:36:01.250783428Z",
            "sha256": "72bed005637ce1e176a91f2823967cf51bd6922b80c71343d65da7097f6fabbe",
            "source": "ossf-package-analysis",
            "modified_time": "2026-05-08T18:05:43Z",
            "versions": [
                "201.99.100"
            ]
        },
        {
            "import_time": "2026-05-12T07:28:48.713652814Z",
            "sha256": "35c3ecacb08f3cfb0b165eadaafd3a0d6acfffc34898a6149370c8cc9ba3843e",
            "source": "amazon-inspector",
            "modified_time": "2026-05-12T06:53:21Z",
            "versions": [
                "201.99.100"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / money-badger-open-rpc-test-bugbount

Package

Name: money-badger-open-rpc-test-bugbount; View open source insights on deps.dev
Purl: pkg:npm/money-badger-open-rpc-test-bugbount

Affected ranges

Affected versions

201.*

201.99.100

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/money-badger-open-rpc-test-bugbount/MAL-2026-3399.json"