MAL-2024-7769

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/noblox.ts-core/MAL-2024-7769.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2024-7769
Published
2024-07-17T15:39:32Z
Modified
2024-10-24T01:01:56Z
Summary
Malicious code in noblox.ts-core (npm)
Details

This package is considered malicious because it contains a heavily obfuscated postinstall.js script with multiple stages of payload execution, resulting in the delivery of QuasarRAT. This allows command and control by a malicious actor.

-= Per source details. Do not edit below this line.=-

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2024-10-16T13:07:36Z",
            "import_time": "2024-10-24T00:56:35.131618992Z",
            "versions": [
                "4.6.7"
            ],
            "source": "reversing-labs",
            "id": "RLMA-2024-06973",
            "sha256": "335fea2702be3dc4b26d5e04e51c601f2a8e9946a65d0946e7f5373d387d0dd9"
        }
    ]
}
References
Credits

Affected packages

npm / noblox.ts-core

Package

Name
noblox.ts-core
View open source insights on deps.dev
Purl
pkg:npm/noblox.ts-core

Affected ranges

Affected versions

4.*

4.6.7