megabank-worklist

{"modified":"2026-04-23T20:50:51Z","published":"2026-04-20T15:51:23Z","schema_version":"1.7.4","id":"MAL-2026-2955","summary":"Malicious code in megabank-worklist (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297)\nThe package megabank-worklist was found to contain malicious code.\n\n## Source: ossf-package-analysis (67b82e2f7e8ec078f92a9f21610cd4f1347f25bbf96416e0a76ade90b60d242f)\nThe OpenSSF Package Analysis project identified 'megabank-worklist' @ 999.99.9 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"npm","name":"megabank-worklist"},"versions":["999.99.9"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"67b82e2f7e8ec078f92a9f21610cd4f1347f25bbf96416e0a76ade90b60d242f","import_time":"2026-04-20T16:31:16.605695094Z","modified_time":"2026-04-20T15:51:23Z","versions":["999.99.9"]},{"source":"amazon-inspector","sha256":"51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297","import_time":"2026-04-23T20:49:10.91788199Z","modified_time":"2026-04-23T20:43:56Z","versions":["999.99.9"]}]}}