@the-coca-cola-company/ngps-global-common-utils

{"modified":"2026-04-16T15:42:07Z","published":"2026-03-24T09:07:58Z","schema_version":"1.7.4","id":"MAL-2026-2410","summary":"Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm)","details":"Malicious post-install script combined with low project popularity indicates potential malware. Arbitrary code execution is a major concern.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3ebe31c5bb51c354ed83627a02c11ca4c8541e042623b1b987255941ffafdaff)\nThe package @the-coca-cola-company/ngps-global-common-utils was found to contain malicious code.\n","affected":[{"package":{"ecosystem":"npm","name":"@the-coca-cola-company/ngps-global-common-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","9.9.0","9.9.9"]}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KHR2P4NQM7HJ6KMSCJ3DCMCX"},{"type":"WEB","url":"https://app.safedep.io/community/malysis/01KHR2P4NQM7HJ6KMSCJ3DCMCX"},{"type":"WEB","url":"https://safedep.io/sl4x0-dependency-confusion-campaign"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]},{"name":"SafeDep","type":"FINDER","contact":["https://safedep.io"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"3ebe31c5bb51c354ed83627a02c11ca4c8541e042623b1b987255941ffafdaff","import_time":"2026-04-07T14:39:17.98122271Z","modified_time":"2026-04-07T14:24:50Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"reversing-labs","sha256":"c8f9e8cd86ecaa7f2080db546f0064ff49df1a741be0cfa86f17778ae97f2fe2","import_time":"2026-04-16T15:38:50.59739279Z","id":"RLMA-2026-01868","modified_time":"2026-04-16T09:39:20Z","versions":["1.0.0","9.9.0","9.9.9"]}]}}