@velora-dex/sdk

{"modified":"2026-07-13T12:20:00Z","published":"2026-04-07T19:23:02Z","schema_version":"1.7.4","id":"MAL-2026-2510","summary":"Malicious code in @velora-dex/sdk (npm)","details":"Malicious npm package executing base64-decoded shell command to download and run stage-2 payload from C2 server (89.36.224.5) targeting macOS\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (21a732dd2745098176d2c19fe3edb359db6f6690b5d14b8d49e8a00b61325311)\nThe package @velora-dex/sdk was found to contain malicious code.\n\n## Source: ossf-package-analysis (013b2c71633a40b8d425f998bb589074e403eea3069a0af42d70a041827475a3)\nThe OpenSSF Package Analysis project identified '@velora-dex/sdk' @ 9.4.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"@velora-dex/sdk"},"versions":["9.4.1"]}],"references":[{"type":"REPORT","url":"https://safedep.io/malicious-velora-dex-sdk-npm-compromised-rat/"},{"type":"REPORT","url":"https://github.com/VeloraDEX/sdk/issues/233"},{"type":"WEB","url":"https://x.com/VeloraDEX/status/2041816006616601040"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@velora-dex/sdk?activeTab=versions"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]},{"name":"SafeDep","type":"FINDER","contact":["https://safedep.io"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"21a732dd2745098176d2c19fe3edb359db6f6690b5d14b8d49e8a00b61325311","import_time":"2026-04-10T17:21:50.564186301Z","modified_time":"2026-04-10T17:02:58Z","versions":["9.4.1"]},{"source":"ossf-package-analysis","sha256":"013b2c71633a40b8d425f998bb589074e403eea3069a0af42d70a041827475a3","import_time":"2026-04-20T00:43:15.38090661Z","modified_time":"2026-04-07T19:23:02Z","versions":["9.4.1"]}]}}