oracle-redis

{"modified":"2026-09-22T18:08:06Z","published":"2026-09-22T18:08:06Z","schema_version":"1.7.4","id":"MAL-2026-16390","summary":"Malicious code in oracle-redis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6)\nThe package publishes as `oracle-redis` but ships a verbatim copy of the ioredis README, source tree, and repository URL (`git://github.com/luin/ioredis.git`), presenting itself as ioredis under a different name. The `package.json` declares two additional runtime dependencies that are not part of ioredis's real dependency set and are never imported anywhere in the shipped `built/` source: `redis-type-intel` ^1.10.5 and `pino-ulid` ^2.12.2. Because they are ordinary `dependencies` with caret ranges, `npm install oracle-redis` resolves and installs those two packages (and their transitive graph) into the installer's `node_modules`, executing whatever lifecycle scripts they declare, even though nothing in the ioredis code being wrapped ever loads them. The combination of a name-squat lure over a popular library plus unused, caret-pinned extra dependencies is a dependency-delivery shape: the harm, if any, arrives through the transitive install of the extra names rather than through this tarball's own code.\n","affected":[{"package":{"ecosystem":"npm","name":"oracle-redis"},"versions":["5.11.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e5f763b250baaea3fed9e4d692825e9864526b8ef614339045f47fff50fb3083","tlsh":"da61ff20dd9a9d732ac441f9e8b502819525c40b2e50fc0db3f953ad4f9e6bf31b9a2d"}],"package_integrity":[{"filename":"oracle-redis-5.11.3.tgz","hashes":{"sha1":"81f13d4426d451a25d109ce4833ea809c375523a","sha512_sri":"sha512-4aapEwKGeVugfaSVZW7NQOo36rcIRa+9Tc6EjHtejGyJeHVWOeDaXHgp0WF9NdwqIVI4SiswiRUi3wEy0yCaDQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/oracle-redis/v/5.11.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020298","import_time":"2026-09-22T18:23:45.268002209Z","modified_time":"2026-09-22T18:08:06Z","sha256":"c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6","source":"amazon-inspector","versions":["5.11.3"]}]}}