MAL-2026-612

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sharedclasses/MAL-2026-612.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-612
Published
2026-01-30T23:47:34Z
Modified
2026-02-02T06:10:25.533049Z
Summary
Malicious code in sharedclasses (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9d92097d15ef8e4712a31a9d8abdaecd9e1afa7d718078fda3457ed45ef6a1c6)

The package sharedclasses was found to contain malicious code.

Source: ossf-package-analysis (27bbcbda48f1ce3d094d88b990959af80ffff4fb11c662dcad442539fcb8ac9b)

The OpenSSF Package Analysis project identified 'sharedclasses' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-01-30T23:47:34Z",
            "import_time": "2026-01-31T00:31:15.507259649Z",
            "source": "ossf-package-analysis",
            "sha256": "27bbcbda48f1ce3d094d88b990959af80ffff4fb11c662dcad442539fcb8ac9b",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-01-31T00:06:35Z",
            "import_time": "2026-01-31T00:31:15.698762234Z",
            "source": "ossf-package-analysis",
            "sha256": "8165cc7e0f3aa458299c11aee3a8c5410b51315917755edc3cff461f660cb794",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "modified_time": "2026-02-02T05:19:43Z",
            "import_time": "2026-02-02T05:54:43.831408135Z",
            "source": "amazon-inspector",
            "sha256": "9d92097d15ef8e4712a31a9d8abdaecd9e1afa7d718078fda3457ed45ef6a1c6",
            "versions": [
                "1.0.1",
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sharedclasses

Package

Name
sharedclasses
View open source insights on deps.dev
Purl
pkg:npm/sharedclasses

Affected ranges

Affected versions

1.*
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sharedclasses/MAL-2026-612.json"