cwanner

{"modified":"2026-03-19T12:23:19Z","published":"2025-12-01T13:06:26Z","schema_version":"1.7.4","id":"MAL-2025-191572","aliases":["SNYK-JS-CWANNER-14152252"],"summary":"Malicious code in cwanner (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b802af5dc124ecff02d4bd0f8cb34612fa149151e1dea636d8235762f0e8c7ce)\nThe package cwanner was found to contain malicious code.\n","affected":[{"package":{"ecosystem":"npm","name":"cwanner","purl":"pkg:npm/cwanner"},"versions":["9.2.0"]}],"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-CWANNER-14152252"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"83cbfc5ae74da819614d4aa3c2766a9ba03677afa884d88cf430f500f6c32230","import_time":"2025-12-02T09:09:43.24383067Z","id":"RLMA-2025-05713","modified_time":"2025-12-01T13:06:26Z","versions":["9.2.0"]},{"source":"amazon-inspector","sha256":"b802af5dc124ecff02d4bd0f8cb34612fa149151e1dea636d8235762f0e8c7ce","import_time":"2025-12-02T21:35:52.208282235Z","modified_time":"2025-12-02T21:11:00Z","versions":["9.2.0"]},{"source":"reversing-labs","sha256":"a46373bd0ee89096e161239acb1c60fa172e64df7d4e8897977bc2aa3581316e","import_time":"2025-12-24T10:07:34.539054396Z","id":"RLUA-2025-06106","modified_time":"2025-12-23T08:04:05Z"},{"source":"reversing-labs","sha256":"44eb34a89a5869bd2f714348e5e484a191c56d816055b5a4b8a5b5d334e5309c","import_time":"2026-03-19T12:20:52.769897439Z","id":"RLUA-2026-01229","modified_time":"2026-03-18T12:45:51Z"}]}}