cms-catalogue

{"modified":"2026-03-23T05:16:26Z","published":"2026-03-21T10:35:35Z","schema_version":"1.7.4","id":"MAL-2026-2011","summary":"Malicious code in cms-catalogue (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d08a53064a76469a8b5ab4afdb3aa2907127f26f98ac8255e3ae650f8ce5d1ba)\nThe package cms-catalogue was found to contain malicious code.\n\n## Source: ossf-package-analysis (b1e5887ae48f20db99c60c5424798e9abab99d40af1c9f62074ea43ddbe9eb82)\nThe OpenSSF Package Analysis project identified 'cms-catalogue' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"cms-catalogue"},"versions":["99.0.0","99.0.1"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"b1e5887ae48f20db99c60c5424798e9abab99d40af1c9f62074ea43ddbe9eb82","import_time":"2026-03-21T10:43:56.140798613Z","modified_time":"2026-03-21T10:35:35Z","versions":["99.0.0"]},{"source":"ossf-package-analysis","sha256":"e2b6e877ee3e0be9b6fa0c5ca347f01ce90381e62e9c5ad293879cb0173b6742","import_time":"2026-03-22T23:10:11.028567254Z","modified_time":"2026-03-21T10:40:18Z","versions":["99.0.1"]},{"source":"amazon-inspector","sha256":"d08a53064a76469a8b5ab4afdb3aa2907127f26f98ac8255e3ae650f8ce5d1ba","import_time":"2026-03-23T05:14:20.835645225Z","modified_time":"2026-03-23T05:11:41Z","versions":["99.0.0","99.0.1"]}]}}