elf-stats-sleighing-bow-514

{"modified":"2025-12-23T21:08:54Z","published":"2025-12-03T12:49:19Z","schema_version":"1.7.4","id":"MAL-2025-191976","summary":"Malicious code in elf-stats-sleighing-bow-514 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ffb75cc156e871168a4a171f65cea2e9a8b2290b2151c079594efdd92945f64)\nThe package elf-stats-sleighing-bow-514 was found to contain malicious code.\n\n## Source: ossf-package-analysis (00467b7fe77f32ee3e16ad6e53dcf0c3ad8c9560b417fdff9cdc80aeb093318e)\nThe OpenSSF Package Analysis project identified 'elf-stats-sleighing-bow-514' @ 1.0.5 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"elf-stats-sleighing-bow-514"},"versions":["1.0.5","1.0.1","1.0.4","1.0.2","1.0.0","1.0.3","1.0.6"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"00467b7fe77f32ee3e16ad6e53dcf0c3ad8c9560b417fdff9cdc80aeb093318e","import_time":"2025-12-03T13:18:21.945173242Z","modified_time":"2025-12-03T13:06:09Z","versions":["1.0.5"]},{"source":"ossf-package-analysis","sha256":"cd8f7fd05f512c6088bd1a4cc94fea9e497c58639038669bebd736552e5f8103","import_time":"2025-12-03T13:18:21.60340928Z","modified_time":"2025-12-03T12:49:19Z","versions":["1.0.1"]},{"source":"ossf-package-analysis","sha256":"e5fa2214e53494ff32a1c83db57828b28c61a1a08b866c395a24384b117e8b56","import_time":"2025-12-03T13:18:21.889623682Z","modified_time":"2025-12-03T12:55:44Z","versions":["1.0.4"]},{"source":"ossf-package-analysis","sha256":"e6fba6cd29b1384bc495a383291386e5167f98db962f8f56be3e0286b976d06a","import_time":"2025-12-03T13:18:21.704776709Z","modified_time":"2025-12-03T12:50:50Z","versions":["1.0.2"]},{"source":"amazon-inspector","sha256":"0ffb75cc156e871168a4a171f65cea2e9a8b2290b2151c079594efdd92945f64","import_time":"2025-12-03T16:09:54.855208433Z","modified_time":"2025-12-03T15:59:29Z","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.6"]},{"source":"reversing-labs","sha256":"2f5d9bf7378e25f666bcbaf2cf1a3e063b43c29ca595737bf9b9ae90e9a3dd10","import_time":"2025-12-23T21:06:54.922503612Z","id":"RLMA-2025-06273","modified_time":"2025-12-23T08:10:04Z","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"]}]}}