mal-2026-466
Vulnerability from ossf_malicious_packages
Published
2026-01-22 17:51
Modified
2026-01-23 01:39
Summary
Malicious code in uuu8lgd (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920)
The package uuu8lgd was found to contain malicious code.
Source: ossf-package-analysis (07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2)
The OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious.
It is considered malicious because:
-
The package communicates with a domain associated with malicious activity.
-
The package executes one or more commands associated with malicious behavior.
Credits
Amazon Inspector
actran@amazon.com
OpenSSF: Package Analysis
github.com/ossf/package-analysis
openssf.slack.com/channels/package_analysis
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "uuu8lgd"
},
"versions": [
"1.0.2",
"1.0.1",
"1.0.10",
"1.0.7",
"1.0.11",
"1.0.14",
"1.0.17",
"1.0.19",
"1.0.22",
"1.0.24"
]
}
],
"credits": [
{
"contact": [
"actran@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/ossf/package-analysis",
"https://openssf.slack.com/channels/package_analysis"
],
"name": "OpenSSF: Package Analysis",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"import_time": "2026-01-22T18:09:51.138487865Z",
"modified_time": "2026-01-22T17:55:49Z",
"sha256": "aa4d9125702fd82fb441bb84144f6be9c8a907df6dafbf8763298164d2eac64e",
"source": "ossf-package-analysis",
"versions": [
"1.0.2"
]
},
{
"import_time": "2026-01-22T18:09:51.019214216Z",
"modified_time": "2026-01-22T17:51:00Z",
"sha256": "f21287ddfeceba75b1d61a1ee1fee1952269d2b5a919db08f079e0fd8ccbcdad",
"source": "ossf-package-analysis",
"versions": [
"1.0.1"
]
},
{
"import_time": "2026-01-22T18:46:55.541958019Z",
"modified_time": "2026-01-22T18:37:28Z",
"sha256": "07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2",
"source": "ossf-package-analysis",
"versions": [
"1.0.10"
]
},
{
"import_time": "2026-01-22T18:46:55.410980561Z",
"modified_time": "2026-01-22T18:13:45Z",
"sha256": "3fdea801a42a9d0815992cfbd09c19069aea4a5e3fa82310a4f1715e2128c620",
"source": "ossf-package-analysis",
"versions": [
"1.0.7"
]
},
{
"import_time": "2026-01-22T18:46:55.711685222Z",
"modified_time": "2026-01-22T18:40:46Z",
"sha256": "d7d2feee8eec94e337eaff29127d096cdbbdd368ad9127e8110c2009fbb5499f",
"source": "ossf-package-analysis",
"versions": [
"1.0.11"
]
},
{
"import_time": "2026-01-22T19:10:29.598224175Z",
"modified_time": "2026-01-22T18:57:31Z",
"sha256": "d3cd4504da698fcf215d47ceadcf35ebd73593e4c0616e481fef430981dffad5",
"source": "ossf-package-analysis",
"versions": [
"1.0.14"
]
},
{
"import_time": "2026-01-22T19:39:15.536150376Z",
"modified_time": "2026-01-22T19:16:06Z",
"sha256": "34100015b0ba37489e9dd70d0c7a246b183ecaeb11ee9aeea197922915433201",
"source": "ossf-package-analysis",
"versions": [
"1.0.17"
]
},
{
"import_time": "2026-01-22T19:39:15.710819514Z",
"modified_time": "2026-01-22T19:35:54Z",
"sha256": "43b84c3ddb9c30dfe6860ac38e3771ba6a9fd0478e3d16dcb39c340a524298b5",
"source": "ossf-package-analysis",
"versions": [
"1.0.19"
]
},
{
"import_time": "2026-01-22T20:08:05.159991024Z",
"modified_time": "2026-01-22T19:55:29Z",
"sha256": "70bfbe5be9f3bb2fdb58474beb0aee2cacde9bd59ea518de5ed291eb7270b4f2",
"source": "ossf-package-analysis",
"versions": [
"1.0.22"
]
},
{
"import_time": "2026-01-22T20:42:32.633062688Z",
"modified_time": "2026-01-22T20:22:45Z",
"sha256": "2469f8a646b986709263e1d49dc00ead1623d19bac17e3288eed4f8480ee121a",
"source": "ossf-package-analysis",
"versions": [
"1.0.24"
]
},
{
"import_time": "2026-01-23T01:36:52.478493641Z",
"modified_time": "2026-01-23T01:13:12Z",
"sha256": "1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920",
"source": "amazon-inspector",
"versions": [
"1.0.2",
"1.0.1",
"1.0.10",
"1.0.7",
"1.0.11",
"1.0.14",
"1.0.17",
"1.0.19",
"1.0.22",
"1.0.24"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920)\nThe package uuu8lgd was found to contain malicious code.\n\n## Source: ossf-package-analysis (07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2)\nThe OpenSSF Package Analysis project identified \u0027uuu8lgd\u0027 @ 1.0.10 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
"id": "MAL-2026-466",
"modified": "2026-01-23T01:39:04Z",
"published": "2026-01-22T17:51:00Z",
"schema_version": "1.7.4",
"summary": "Malicious code in uuu8lgd (npm)"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…