jsonrecap

{"modified":"2026-03-19T12:23:21Z","published":"2025-12-23T08:18:00Z","schema_version":"1.7.4","id":"MAL-2025-192812","aliases":["SNYK-JS-JSONRECAP-14152271"],"summary":"Malicious code in jsonrecap (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a7e3ea65451f642ffd038933f2ca3b5dab39d6ee6979b4783353af6250dc22e9)\nThe package jsonrecap was found to contain malicious code.\n","affected":[{"package":{"ecosystem":"npm","name":"jsonrecap","purl":"pkg:npm/jsonrecap"},"versions":["3.1.8"]}],"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-JSONRECAP-14152271"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"0f2988a1bf0dbfd6ff12cb50f4278ad710593f273f8e6e8b594f6d95081ca1aa","import_time":"2025-12-24T10:07:23.973509286Z","id":"RLMA-2025-06378","modified_time":"2025-12-23T08:18:00Z","versions":["3.1.8"]},{"source":"amazon-inspector","sha256":"a7e3ea65451f642ffd038933f2ca3b5dab39d6ee6979b4783353af6250dc22e9","import_time":"2026-01-02T21:35:52.811798026Z","modified_time":"2026-01-02T21:29:26Z","versions":["3.1.8"]},{"source":"reversing-labs","sha256":"a41d1fcb63a586513d9cca8b1183243004470500c8db731516479b0a771a3dbb","import_time":"2026-03-19T12:20:55.441552276Z","id":"RLUA-2026-01378","modified_time":"2026-03-18T12:56:10Z"}]}}