MAL-2026-3806

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@citi-icg-158830/elemental-chameleon/MAL-2026-3806.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-3806

Published

2026-05-16T19:55:24Z

Modified

2026-05-19T18:02:15.052804182Z

Summary

Malicious code in @citi-icg-158830/elemental-chameleon (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (698e88fd9d64450847d476a41187198acc173deacf9c5484791a4fdb6fbbe969)

The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.

Source: ossf-package-analysis (584d2e027d86f89b78898d46a4aab1a0bd131897750c876c729e2247b1479a40)

The OpenSSF Package Analysis project identified '@citi-icg-158830/elemental-chameleon' @ 0.0.0-defensive-callback.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "584d2e027d86f89b78898d46a4aab1a0bd131897750c876c729e2247b1479a40",
            "import_time": "2026-05-16T20:20:00.60941279Z",
            "modified_time": "2026-05-16T20:05:33Z",
            "versions": [
                "0.0.0-defensive-callback.1"
            ],
            "source": "ossf-package-analysis"
        },
        {
            "sha256": "e5553e657a7ec3b5a6461a94d949a78b9bdb8915d8d37c0144d6d6815c209680",
            "import_time": "2026-05-16T20:20:00.431962221Z",
            "modified_time": "2026-05-16T19:55:24Z",
            "versions": [
                "0.0.0-defensive-callback"
            ],
            "source": "ossf-package-analysis"
        },
        {
            "sha256": "698e88fd9d64450847d476a41187198acc173deacf9c5484791a4fdb6fbbe969",
            "import_time": "2026-05-19T17:50:10.943505616Z",
            "modified_time": "2026-05-19T16:47:48Z",
            "versions": [
                "0.0.0-defensive-callback.1",
                "0.0.0-defensive-callback"
            ],
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / @citi-icg-158830/elemental-chameleon

Package

Name: @citi-icg-158830/elemental-chameleon; View open source insights on deps.dev
Purl: pkg:npm/%40citi-icg-158830%2Felemental-chameleon

Affected ranges

Affected versions

0.*

0.0.0-defensive-callback

0.0.0-defensive-callback.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@citi-icg-158830/elemental-chameleon/MAL-2026-3806.json"