MAL-2024-8849

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/video.min/MAL-2024-8849.json

JSON Data

https://api.test.osv.dev/v1/vulns/MAL-2024-8849

Published

2024-09-09T05:56:27Z

Modified

2024-09-09T14:06:36Z

Summary

Malicious code in video.min (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (1b2a0713372942343830cd53ad3ad5ffe4dcf7e827523510ef79e32b38f67db3)

The OpenSSF Package Analysis project identified 'video.min' @ 1.0.22 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2024-09-09T05:56:27Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T06:07:34.639363786Z",
            "sha256": "07ef81028795b68dd8a734f2c2c3608ed9a4a440707058b6d23efd3c0eae5ed5",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "modified_time": "2024-09-09T06:38:41Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T06:39:40.963434475Z",
            "sha256": "d9b5424490f1a42706a0cf2bdf96eae92fbb598fc2322027703f2378fc93260d",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2024-09-09T06:55:33Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T07:05:23.36164559Z",
            "sha256": "1b2a0713372942343830cd53ad3ad5ffe4dcf7e827523510ef79e32b38f67db3",
            "versions": [
                "1.0.22"
            ]
        },
        {
            "modified_time": "2024-09-09T07:52:29Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T08:07:26.093837896Z",
            "sha256": "129c0f91ae83604d47172c5afee5ce4e61f67486cb4b5d13fc6704917530d7f6",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "modified_time": "2024-09-09T11:30:52Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T11:34:01.671771054Z",
            "sha256": "79750f62e6caf887bcebcf4de078df93d965c13af9ca247f142e1cbbeb8c9a3a",
            "versions": [
                "1.0.31"
            ]
        },
        {
            "modified_time": "2024-09-09T11:35:54Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T12:08:39.915678417Z",
            "sha256": "89e9dbd6b200e210ac63f788586755a1cffbac761243a7cc873636b7442bc369",
            "versions": [
                "1.0.32"
            ]
        },
        {
            "modified_time": "2024-09-09T11:51:46Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T12:08:40.215823261Z",
            "sha256": "b0b24e936cbbc7e7de204b6e362d6236b61de9d5616485d554199a12103e5eb3",
            "versions": [
                "1.0.33"
            ]
        },
        {
            "modified_time": "2024-09-09T13:21:03Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T13:36:15.014313292Z",
            "sha256": "d5fe52f034c526a09eb15ad8b3419bb67669f51431ee8ee475fb4d329bfedb03",
            "versions": [
                "1.0.38"
            ]
        },
        {
            "modified_time": "2024-09-09T13:43:07Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T14:05:22.546194691Z",
            "sha256": "a219f5d7f433d9afc7d996081fa7c3fd57a1d127d00d861dbd3dd86ca20e19f7",
            "versions": [
                "1.0.39"
            ]
        },
        {
            "modified_time": "2024-09-09T13:51:00Z",
            "source": "ossf-package-analysis",
            "import_time": "2024-09-09T14:05:22.622259774Z",
            "sha256": "b4a50efd5026d322267045de28c0a9bac0cbd503e63a7354d3a63635b4ce1325",
            "versions": [
                "1.0.40"
            ]
        }
    ]
}

References

Credits

- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / video.min

Package

Name: video.min; View open source insights on deps.dev
Purl: pkg:npm/video.min

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.22

1.0.31

1.0.32

1.0.33

1.0.38

1.0.39

1.0.40

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/video.min/MAL-2024-8849.json"