MAL-2026-466

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uuu8lgd/MAL-2026-466.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-466

Published

2026-01-22T17:51:00Z

Modified

2026-01-23T01:53:43Z

Summary

Malicious code in uuu8lgd (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920)

The package uuu8lgd was found to contain malicious code.

Source: ossf-package-analysis (07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2)

The OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-01-22T18:09:51.138487865Z",
            "modified_time":  "2026-01-22T17:55:49Z",
            "sha256":  "aa4d9125702fd82fb441bb84144f6be9c8a907df6dafbf8763298164d2eac64e",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.2"
            ]
        },
        {
            "import_time":  "2026-01-22T18:09:51.019214216Z",
            "modified_time":  "2026-01-22T17:51:00Z",
            "sha256":  "f21287ddfeceba75b1d61a1ee1fee1952269d2b5a919db08f079e0fd8ccbcdad",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "import_time":  "2026-01-22T18:46:55.541958019Z",
            "modified_time":  "2026-01-22T18:37:28Z",
            "sha256":  "07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.10"
            ]
        },
        {
            "import_time":  "2026-01-22T18:46:55.410980561Z",
            "modified_time":  "2026-01-22T18:13:45Z",
            "sha256":  "3fdea801a42a9d0815992cfbd09c19069aea4a5e3fa82310a4f1715e2128c620",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.7"
            ]
        },
        {
            "import_time":  "2026-01-22T18:46:55.711685222Z",
            "modified_time":  "2026-01-22T18:40:46Z",
            "sha256":  "d7d2feee8eec94e337eaff29127d096cdbbdd368ad9127e8110c2009fbb5499f",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.11"
            ]
        },
        {
            "import_time":  "2026-01-22T19:10:29.598224175Z",
            "modified_time":  "2026-01-22T18:57:31Z",
            "sha256":  "d3cd4504da698fcf215d47ceadcf35ebd73593e4c0616e481fef430981dffad5",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.14"
            ]
        },
        {
            "import_time":  "2026-01-22T19:39:15.536150376Z",
            "modified_time":  "2026-01-22T19:16:06Z",
            "sha256":  "34100015b0ba37489e9dd70d0c7a246b183ecaeb11ee9aeea197922915433201",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.17"
            ]
        },
        {
            "import_time":  "2026-01-22T19:39:15.710819514Z",
            "modified_time":  "2026-01-22T19:35:54Z",
            "sha256":  "43b84c3ddb9c30dfe6860ac38e3771ba6a9fd0478e3d16dcb39c340a524298b5",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.19"
            ]
        },
        {
            "import_time":  "2026-01-22T20:08:05.159991024Z",
            "modified_time":  "2026-01-22T19:55:29Z",
            "sha256":  "70bfbe5be9f3bb2fdb58474beb0aee2cacde9bd59ea518de5ed291eb7270b4f2",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.22"
            ]
        },
        {
            "import_time":  "2026-01-22T20:42:32.633062688Z",
            "modified_time":  "2026-01-22T20:22:45Z",
            "sha256":  "2469f8a646b986709263e1d49dc00ead1623d19bac17e3288eed4f8480ee121a",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.24"
            ]
        },
        {
            "import_time":  "2026-01-23T01:36:52.478493641Z",
            "modified_time":  "2026-01-23T01:13:12Z",
            "sha256":  "1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2",
                "1.0.1",
                "1.0.10",
                "1.0.7",
                "1.0.11",
                "1.0.14",
                "1.0.17",
                "1.0.19",
                "1.0.22",
                "1.0.24"
            ]
        }
    ]
}

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / uuu8lgd

Package

Name: uuu8lgd; View open source insights on deps.dev
Purl: pkg:npm/uuu8lgd

Affected ranges

Affected versions

1.*

1.0.1

1.0.2

1.0.7

1.0.10

1.0.11

1.0.14

1.0.17

1.0.19

1.0.22

1.0.24

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uuu8lgd/MAL-2026-466.json"