Malicious code in @bb1ptest23/test-paket (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (88718be23e6bf753453adc1110580e87b675e7881b945d419746afe4bebcfa5e) The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ossf-package-analysis (b6b02b5a41ef4b1d07f98023a6daa2629818ee31fd68a82af64c9f52f78bec6c) The OpenSSF Package Analysis project identified '@bb1ptest23/test-paket' @ 1.0.3 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
MAL-2026-17201
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17201
@bb1ptest23/test-paket
Source reference: /affected/0/package/name
- Affected versions
- 1.0.3
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "@bb1ptest23/test-paket",
"purl": "pkg:npm/%40bb1ptest23/test-paket",
"ecosystem": "npm"
},
"versions": [
"1.0.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bb1ptest23/test-paket/MAL-2026-17201.json",
"indicators": {
"evidence_files": [
{
"path": "check.js",
"tlsh": "63d095442c83320411a54be934116007fd0bd9f113a4d140b95c81d55fd55f045f3dec",
"sha256": "9c48ac7f94402623171dcf5f698aef9a3ec943443da48143bd25aab3fd4ea0dc"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "aeaec4e173d902195e3d52f174e3ddea2ae2732c",
"sha512_sri": "sha512-j9NsPDZm6/Kvc3nSxqv5DdJt4erRxkCf4oGp6RmbdCJ4T0negJBN/NH27eWdhuE74s9HUmtx81FfbjqME718Cg=="
},
"filename": "test-paket-1.0.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33435 · Revision 1
- Added to Heist Feed
- Publisher date