MAL-2026-4445

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@signetai/signet-memory-openclaw/MAL-2026-4445.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-4445

Withdrawn

2026-05-26T21:14:22Z

Published

2026-05-20T20:18:22Z

Modified

2026-08-06T15:34:45.352809126Z

Summary

Malicious code in @signetai/signet-memory-openclaw (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c0ad0b94bf8d4fa9787ee3ae220aa20bc7dde35d2f7a90d2a8e19a8781b8a552)

On plugin registration in 'full' mode the package reads the installer's Claude Code OAuth credential from ~/.claude/.credentials.json (and the.credentials.json variant) via a readClaudeCodeOAuthToken() helper. An installFetchSanitizer() function then replaces globalThis.fetch: for any outbound request whose URL matches api.anthropic.com, the wrapper strips x-api-key, injects Authorization: Bearer <token read from the installer's Claude credentials file>, and prepends a system block containing Claude Code impersonation headers (x-anthropic-billing-header: ccversion=...; ccentrypoint=sdk-cli; cch=00000;) plus beta flags including claude-code-20250219 and oauth-2025-04-20. A parallel installSdkSanitizer() walks the CommonJS require cache to locate the loaded Anthropic SDK base class and patches its prototype so requests made through the SDK receive the same auth swap and billing-header injection, catching traffic that bypasses the global fetch. The net effect is that Anthropic API calls issued from the host process (both by this package and by any other code loaded in the same process) are authenticated with the installer's personal Claude Code subscription OAuth token and disguised as originating from the Claude Code CLI, causing usage to be billed against the installer's Anthropic subscription. None of this is disclosed in the package description or configuration schema. The package advertises itself as an agent memory adapter; harvesting the installer's Anthropic subscription credential and impersonating the Claude Code CLI is unrelated to that stated purpose and may also violate the installer's Anthropic terms of service.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003655",
            "import_time": "2026-05-26T05:51:03.195852707Z",
            "sha256": "48b5b26374c1a6550062b994aa59e7d10aa64ce33323b68e8a8445d659ecd71d",
            "versions": [
                "0.123.12"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-05-21T00:07:09Z"
        },
        {
            "id": "IN-MAL-2026-003609",
            "import_time": "2026-05-26T05:50:57.798905214Z",
            "sha256": "721a603ed67c51b01bb68c99b863797017739e2c459fc24f289a4682c9c864b5",
            "modified_time": "2026-05-20T20:18:22Z",
            "source": "amazon-inspector",
            "versions": [
                "0.123.3"
            ]
        },
        {
            "id": "IN-MAL-2026-003610",
            "import_time": "2026-05-26T05:50:57.903950687Z",
            "sha256": "873c72f988cc0c4ac4519546b3248c88cd803ff9f1d1c347e42afcf96ee2acd1",
            "versions": [
                "0.123.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-05-20T20:18:23Z"
        },
        {
            "id": "IN-MAL-2026-003654",
            "import_time": "2026-05-26T05:51:03.096656797Z",
            "sha256": "b16e55a5379336a0ab822ee9fe70b20023e452595f41cfe2624464aadb73d390",
            "modified_time": "2026-05-21T00:07:08Z",
            "source": "amazon-inspector",
            "versions": [
                "0.123.12"
            ]
        },
        {
            "import_time": "2026-08-05T16:13:44.543636577Z",
            "id": "IN-MAL-2026-015781",
            "sha256": "567f7128d1dda526cf7c81f917222a4ac3e8a9b124017585ba9ffa2528293e27",
            "modified_time": "2026-08-05T15:39:09Z",
            "source": "amazon-inspector",
            "versions": [
                "0.162.3"
            ]
        },
        {
            "import_time": "2026-08-05T21:31:22.429297696Z",
            "id": "IN-MAL-2026-015905",
            "sha256": "874b4e0ab3a6b432ff9a58c601c8aa67026b1a00ebc3090beb07cb111e3a95a3",
            "modified_time": "2026-08-05T21:25:50Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.5"
            ]
        },
        {
            "id": "IN-MAL-2026-015904",
            "import_time": "2026-08-05T21:31:22.340857749Z",
            "sha256": "87559bd60d102d2015bed67f8d6b864a03a16f43dff51cba9a2a949861ee0b78",
            "modified_time": "2026-08-05T21:25:40Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.6"
            ]
        },
        {
            "import_time": "2026-08-05T21:31:21.967963342Z",
            "id": "IN-MAL-2026-015900",
            "sha256": "c0ad0b94bf8d4fa9787ee3ae220aa20bc7dde35d2f7a90d2a8e19a8781b8a552",
            "modified_time": "2026-08-05T21:25:10Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.9"
            ]
        },
        {
            "import_time": "2026-08-05T21:31:22.058666584Z",
            "id": "IN-MAL-2026-015901",
            "sha256": "f7f6905a9cd4f92d7f5ee428f563e81c4d4c8deda773f6bea36605f2e358761b",
            "modified_time": "2026-08-05T21:25:19Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.8"
            ]
        },
        {
            "id": "IN-MAL-2026-015902",
            "import_time": "2026-08-05T21:31:22.151442925Z",
            "sha256": "0f584ae44c35e4a58c99094740ba743570ff4ffc5954fda07f3e9cff33c10553",
            "versions": [
                "0.163.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T21:25:25Z"
        },
        {
            "id": "IN-MAL-2026-015903",
            "import_time": "2026-08-05T21:31:22.245505589Z",
            "sha256": "1fe7e505b06a992d5418d12ecc67c227b669f82fa144750ed66d830c695b1f5b",
            "versions": [
                "0.163.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T21:25:32Z"
        },
        {
            "id": "IN-MAL-2026-016069",
            "import_time": "2026-08-06T13:08:44.415553931Z",
            "sha256": "3d2fc22a700175cec3a81756beb51c58c97bb5b581163be175fb142ced460e3c",
            "modified_time": "2026-08-06T12:26:53Z",
            "source": "amazon-inspector",
            "versions": [
                "0.159.8"
            ]
        },
        {
            "id": "IN-MAL-2026-016088",
            "import_time": "2026-08-06T13:08:47.661061163Z",
            "sha256": "9137b127f4e31646810c6643617f61e315c2693e5292918809ef611e85b0293a",
            "versions": [
                "0.148.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:29:36Z"
        },
        {
            "id": "IN-MAL-2026-016055",
            "import_time": "2026-08-06T13:08:42.927460248Z",
            "sha256": "73b2097f548a3fe48b7e35dbf8f128311aebe9e3062cda6dcf60e8890ce8df82",
            "modified_time": "2026-08-06T12:24:57Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.17"
            ]
        },
        {
            "import_time": "2026-08-06T13:08:47.883939884Z",
            "id": "IN-MAL-2026-016089",
            "sha256": "63e868d0d4797163cc25905f459fd1228d559d163e0f71a2b54fa88fcca3f131",
            "modified_time": "2026-08-06T12:29:45Z",
            "source": "amazon-inspector",
            "versions": [
                "0.147.21"
            ]
        },
        {
            "import_time": "2026-08-06T13:08:44.062837339Z",
            "id": "IN-MAL-2026-016066",
            "sha256": "d212a3f34ae2fbec5eb8c4ab8d77208fe439a6352851915a2526230bf97132af",
            "modified_time": "2026-08-06T12:26:26Z",
            "source": "amazon-inspector",
            "versions": [
                "0.159.12"
            ]
        },
        {
            "import_time": "2026-08-06T13:08:43.557109371Z",
            "id": "IN-MAL-2026-016061",
            "sha256": "e08e568f0162512a8138d0b4d66f486f129f487cc0d6b8094205a0a67918ba82",
            "modified_time": "2026-08-06T12:25:47Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.13"
            ]
        },
        {
            "id": "IN-MAL-2026-016064",
            "import_time": "2026-08-06T13:08:43.831064246Z",
            "sha256": "f0b73a9f5f0d7d2c09e746e6a69a7a66c0ebd553e16300375a11aa9c9c7d6f34",
            "versions": [
                "0.161.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:26:10Z"
        },
        {
            "import_time": "2026-08-06T13:08:43.276756706Z",
            "id": "IN-MAL-2026-016058",
            "sha256": "36030ab477e8fc3afb024035a84a4976d01064ae01c55711b82592cd312d969a",
            "modified_time": "2026-08-06T12:25:20Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.16"
            ]
        },
        {
            "id": "IN-MAL-2026-016067",
            "import_time": "2026-08-06T13:08:44.159700283Z",
            "sha256": "c185f3a37692231718281c010844734951fcbf8613ec883f41b784727a1bdf36",
            "modified_time": "2026-08-06T12:26:35Z",
            "source": "amazon-inspector",
            "versions": [
                "0.160.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016082",
            "import_time": "2026-08-06T13:08:46.388831985Z",
            "sha256": "d359092b89564e94af1fb1177d2eb27f22b3bdb51b657b949c236fd486b822ff",
            "versions": [
                "0.150.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:28:45Z"
        },
        {
            "id": "IN-MAL-2026-016077",
            "import_time": "2026-08-06T13:08:45.45954802Z",
            "sha256": "dd5a24631c2cb71db0803082eb2044885686876e643dc31362ec7c3f151b26f7",
            "versions": [
                "0.154.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:28:03Z"
        },
        {
            "id": "IN-MAL-2026-016060",
            "import_time": "2026-08-06T13:08:43.460909121Z",
            "sha256": "0e27682759279b28bee0af80f7a66fecac8fcefe0ef116224366c581de4da454",
            "modified_time": "2026-08-06T12:25:39Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.14"
            ]
        },
        {
            "import_time": "2026-08-06T13:08:43.371238341Z",
            "id": "IN-MAL-2026-016059",
            "sha256": "277f3c562a85ebf91b78719e0a5126523d06447366a377d449b848310b867301",
            "modified_time": "2026-08-06T12:25:31Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.15"
            ]
        },
        {
            "id": "IN-MAL-2026-016084",
            "import_time": "2026-08-06T13:08:46.845784073Z",
            "sha256": "42b90aab7f49de65fe5d99f23dab7a42e9b27d468989d8cb756ca7ef5abaca4b",
            "modified_time": "2026-08-06T12:29:01Z",
            "source": "amazon-inspector",
            "versions": [
                "0.150.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016080",
            "import_time": "2026-08-06T13:08:45.888189232Z",
            "sha256": "8441f1b28e7631e43b4179fbd1002403abec5f176f11d5e4a958a879701fcf08",
            "modified_time": "2026-08-06T12:28:28Z",
            "source": "amazon-inspector",
            "versions": [
                "0.154.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016078",
            "import_time": "2026-08-06T13:08:45.643164962Z",
            "sha256": "8ebaff2d1502af74202982b6474586225cbe5d80018ff673b53b14d647cd11c3",
            "versions": [
                "0.154.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:28:11Z"
        },
        {
            "id": "IN-MAL-2026-016070",
            "import_time": "2026-08-06T13:08:44.526645577Z",
            "sha256": "e1eb6e51f27a5718ebea5186a6213ef0b601ad4b1e13993aa36faaadb17adf33",
            "versions": [
                "0.159.6"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:02Z"
        },
        {
            "id": "IN-MAL-2026-016065",
            "import_time": "2026-08-06T13:08:43.930946849Z",
            "sha256": "6e5cd41a1a0f88c3991525a6f79b68dee88e4ccfd5e34b12ada5c067237d0af4",
            "modified_time": "2026-08-06T12:26:19Z",
            "source": "amazon-inspector",
            "versions": [
                "0.161.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016056",
            "import_time": "2026-08-06T13:08:43.043419241Z",
            "sha256": "d8a0c4064d3f7e77c135172f95cb1e65be8208d5a62639f22437102d3568d100",
            "versions": [
                "0.163.19"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:25:05Z"
        },
        {
            "import_time": "2026-08-06T13:08:43.741805848Z",
            "id": "IN-MAL-2026-016063",
            "sha256": "f3b02dfe413b7e0ba19fbfda0276fc641e5df50a724e4136a959f82754850727",
            "modified_time": "2026-08-06T12:26:03Z",
            "source": "amazon-inspector",
            "versions": [
                "0.162.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016071",
            "import_time": "2026-08-06T13:08:44.657023131Z",
            "sha256": "f83683a4419bf4161e98c271c2d18d70245f34f887a93377b2d4c8d3a36d1fdd",
            "versions": [
                "0.157.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:09Z"
        },
        {
            "id": "IN-MAL-2026-016090",
            "import_time": "2026-08-06T13:08:48.008942867Z",
            "sha256": "7d17d479bc2ee472278bddb3d698b3b112b3f02a1ebc9ecd0128621e40cac80c",
            "modified_time": "2026-08-06T12:29:55Z",
            "source": "amazon-inspector",
            "versions": [
                "0.147.18"
            ]
        },
        {
            "id": "IN-MAL-2026-016057",
            "import_time": "2026-08-06T13:08:43.140628898Z",
            "sha256": "2c5ac580f547ed12d2778cc87f650488dc4669c09300e3d339aeee0f197693e1",
            "modified_time": "2026-08-06T12:25:13Z",
            "source": "amazon-inspector",
            "versions": [
                "0.164.1"
            ]
        },
        {
            "import_time": "2026-08-06T13:08:43.64475155Z",
            "id": "IN-MAL-2026-016062",
            "sha256": "3fa5a0e48480a548cb7fdaa1652b9d3000cdfb17ce7be5efdeaf020164205ef4",
            "modified_time": "2026-08-06T12:25:54Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016072",
            "import_time": "2026-08-06T13:08:44.744419151Z",
            "sha256": "693f213c2dfd1534eb2fcca3a9ca324258cc2bfe108094a93d3d310852cbb088",
            "versions": [
                "0.157.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:19Z"
        },
        {
            "id": "IN-MAL-2026-016068",
            "import_time": "2026-08-06T13:08:44.316507551Z",
            "sha256": "85faa42a024e7c8996a7f7f32539fc39177d679575e864ec729b46b913a2f475",
            "versions": [
                "0.159.10"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:26:43Z"
        },
        {
            "import_time": "2026-08-06T13:08:46.525072164Z",
            "id": "IN-MAL-2026-016083",
            "sha256": "966737e06f54ddbdcfaee0b0d00ccece938cb4eec01f61936e544d0cadb79bc5",
            "modified_time": "2026-08-06T12:28:53Z",
            "source": "amazon-inspector",
            "versions": [
                "0.150.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016074",
            "import_time": "2026-08-06T13:08:44.948178905Z",
            "sha256": "9beb1baefcd21b2d3800320d54a8fadcafa14be579f8a92733a41612de165479",
            "versions": [
                "0.156.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:35Z"
        },
        {
            "import_time": "2026-08-06T13:08:42.834913283Z",
            "id": "IN-MAL-2026-016054",
            "sha256": "9ccedfb5fbf76205e1752720220c7368be2a4e7a67116a994191373ed50f2a01",
            "modified_time": "2026-08-06T12:24:50Z",
            "source": "amazon-inspector",
            "versions": [
                "0.163.18"
            ]
        },
        {
            "id": "IN-MAL-2026-016087",
            "import_time": "2026-08-06T13:08:47.453436291Z",
            "sha256": "e2ada2fc679cb7f606882e9fe41b0d5924e6069c8d50caf5e4ef070deb5b50b4",
            "versions": [
                "0.147.19"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:29:28Z"
        },
        {
            "id": "IN-MAL-2026-016086",
            "import_time": "2026-08-06T13:08:47.208543518Z",
            "sha256": "ffb3f6c79fc665dd01ccc4521f2c9dccf15d5327a319d55639dc663ff6d7d68b",
            "modified_time": "2026-08-06T12:29:19Z",
            "source": "amazon-inspector",
            "versions": [
                "0.148.8"
            ]
        },
        {
            "id": "IN-MAL-2026-016081",
            "import_time": "2026-08-06T13:08:46.192012547Z",
            "sha256": "0e919f2b6c50aa58f67bcd2dd8dac8bdc8d2e9ab7eea925432f498a44017714e",
            "modified_time": "2026-08-06T12:28:36Z",
            "source": "amazon-inspector",
            "versions": [
                "0.154.2"
            ]
        },
        {
            "id": "IN-MAL-2026-016075",
            "import_time": "2026-08-06T13:08:45.12086732Z",
            "sha256": "4c87f11841ec979d7c24b1222e6495cf5acc08d366774c63d7b9c5184d1f611a",
            "versions": [
                "0.155.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:43Z"
        },
        {
            "id": "IN-MAL-2026-016085",
            "import_time": "2026-08-06T13:08:47.055280394Z",
            "sha256": "85174f822ce41c10a52e5be4c49d5358d39303088471adcf2a86372425c0f929",
            "versions": [
                "0.149.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:29:10Z"
        },
        {
            "id": "IN-MAL-2026-016073",
            "import_time": "2026-08-06T13:08:44.839676207Z",
            "sha256": "bbacc1eab6de08478b3151f77dc78fcefecbebf8dc7d8e37df188cba8aface7f",
            "modified_time": "2026-08-06T12:27:26Z",
            "source": "amazon-inspector",
            "versions": [
                "0.157.3"
            ]
        },
        {
            "id": "IN-MAL-2026-016079",
            "import_time": "2026-08-06T13:08:45.771674107Z",
            "sha256": "f93ba7f4e5a5be7c97fb05d68970690bbf7bb73208c66601d97a40b7e6cce031",
            "modified_time": "2026-08-06T12:28:20Z",
            "source": "amazon-inspector",
            "versions": [
                "0.154.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016076",
            "import_time": "2026-08-06T13:08:45.259106501Z",
            "sha256": "fe1d01aba95d59b0a5cdd8f4d6b074f405badd0871f3ad26079e3fbee91c5f1e",
            "versions": [
                "0.155.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T12:27:52Z"
        },
        {
            "import_time": "2026-08-06T15:19:35.238195102Z",
            "id": "IN-MAL-2026-016651",
            "sha256": "c7af9fb234dac315f8a8828596df869630ea13a6596c45d9133dcb607b35c28e",
            "modified_time": "2026-08-06T14:36:40Z",
            "source": "amazon-inspector",
            "versions": [
                "0.164.2"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
  - inspector-research@amazon.com

Affected packages

npm / @signetai/signet-memory-openclaw

Package

Name: @signetai/signet-memory-openclaw; View open source insights on deps.dev
Purl: pkg:npm/%40signetai/signet-memory-openclaw

Affected ranges

Affected versions

0.*

0.123.3

0.123.12

0.147.18

0.147.19

0.147.21

0.148.2

0.148.8

0.149.0

0.150.0

0.150.1

0.150.2

0.154.0

0.154.1

0.154.2

0.154.3

0.154.4

0.155.1

0.155.3

0.156.1

0.157.3

0.157.4

0.157.5

0.159.6

0.159.8

0.159.10

0.159.12

0.160.0

0.161.0

0.161.2

0.162.1

0.162.3

0.163.1

0.163.4

0.163.5

0.163.6

0.163.7

0.163.8

0.163.9

0.163.13

0.163.14

0.163.15

0.163.16

0.163.17

0.163.18

0.163.19

0.164.1

0.164.2

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "tlsh": "a4c4fa4a79f73021036371b5796f8006b93894036918eda8fa6cd2e09f4953686f7fed",
            "sha256": "0c06e5bdcf287e7311bd092421d92a7bf615b6e4d2d6ec1b6b2a8a6497d24df3"
        },
        {
            "path": "dist/index.d.ts",
            "tlsh": "1b021286f92b11237dca9682ebfe40811e2451033738acfafde956910f9609c72f764c",
            "sha256": "afbbe995c5b0073cebad6c29b330ee31c6892b0fe3b4a99392784cabc5289fcd"
        }
    ],
    "package_integrity": [
        {
            "filename": "signet-memory-openclaw-0.123.3.tgz",
            "hashes": {
                "sha1": "153689ee19da332c9fbb962c3fb367183ec5b378",
                "sha512_sri": "sha512-RPWKq3GdCXqKAryaiEr5Z70FCRXj6XqxSMfwxo3dFGCGqV6q7b6TFMyu96MlUsd0Nk4nvz6oUqW2TnrH2lBfAA=="
            }
        }
    ],
    "domains": [
        "34.11.16.104.in-addr.arpa"
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@signetai/signet-memory-openclaw/MAL-2026-4445.json"