MAL-2026-804

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/breadcrumb-service/MAL-2026-804.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-804
Published
2026-02-06T12:30:53Z
Modified
2026-02-22T23:28:25.016759Z
Summary
Malicious code in breadcrumb-service (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (46f4e9359f962e7c7082988e5a0af26520798dd321ecda643cb8d14268ec9c5b)

The package breadcrumb-service was found to contain malicious code.

Source: ossf-package-analysis (883dd2539c160123211625ac16fcb503ddaa9a07ba28e19784ab809cf8b04707)

The OpenSSF Package Analysis project identified 'breadcrumb-service' @ 999.9.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "883dd2539c160123211625ac16fcb503ddaa9a07ba28e19784ab809cf8b04707",
            "source": "ossf-package-analysis",
            "modified_time": "2026-02-06T12:30:53Z",
            "import_time": "2026-02-06T12:49:26.957330895Z",
            "versions": [
                "999.9.0"
            ]
        },
        {
            "sha256": "46f4e9359f962e7c7082988e5a0af26520798dd321ecda643cb8d14268ec9c5b",
            "source": "amazon-inspector",
            "modified_time": "2026-02-06T15:49:29Z",
            "import_time": "2026-02-06T16:18:15.843404508Z",
            "versions": [
                "999.9.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / breadcrumb-service

Package

Name
breadcrumb-service
View open source insights on deps.dev
Purl
pkg:npm/breadcrumb-service

Affected ranges

Affected versions

999.*
999.9.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/breadcrumb-service/MAL-2026-804.json"