uuu8lgd

{"modified":"2026-01-23T01:39:04Z","published":"2026-01-22T17:51:00Z","schema_version":"1.7.4","id":"MAL-2026-466","summary":"Malicious code in uuu8lgd (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920)\nThe package uuu8lgd was found to contain malicious code.\n\n## Source: ossf-package-analysis (07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2)\nThe OpenSSF Package Analysis project identified 'uuu8lgd' @ 1.0.10 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"uuu8lgd"},"versions":["1.0.2","1.0.1","1.0.10","1.0.7","1.0.11","1.0.14","1.0.17","1.0.19","1.0.22","1.0.24"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"aa4d9125702fd82fb441bb84144f6be9c8a907df6dafbf8763298164d2eac64e","import_time":"2026-01-22T18:09:51.138487865Z","modified_time":"2026-01-22T17:55:49Z","versions":["1.0.2"]},{"source":"ossf-package-analysis","sha256":"f21287ddfeceba75b1d61a1ee1fee1952269d2b5a919db08f079e0fd8ccbcdad","import_time":"2026-01-22T18:09:51.019214216Z","modified_time":"2026-01-22T17:51:00Z","versions":["1.0.1"]},{"source":"ossf-package-analysis","sha256":"07f7eda587433e48aed22a16c8f76973b55a61815311f38620239874795203b2","import_time":"2026-01-22T18:46:55.541958019Z","modified_time":"2026-01-22T18:37:28Z","versions":["1.0.10"]},{"source":"ossf-package-analysis","sha256":"3fdea801a42a9d0815992cfbd09c19069aea4a5e3fa82310a4f1715e2128c620","import_time":"2026-01-22T18:46:55.410980561Z","modified_time":"2026-01-22T18:13:45Z","versions":["1.0.7"]},{"source":"ossf-package-analysis","sha256":"d7d2feee8eec94e337eaff29127d096cdbbdd368ad9127e8110c2009fbb5499f","import_time":"2026-01-22T18:46:55.711685222Z","modified_time":"2026-01-22T18:40:46Z","versions":["1.0.11"]},{"source":"ossf-package-analysis","sha256":"d3cd4504da698fcf215d47ceadcf35ebd73593e4c0616e481fef430981dffad5","import_time":"2026-01-22T19:10:29.598224175Z","modified_time":"2026-01-22T18:57:31Z","versions":["1.0.14"]},{"source":"ossf-package-analysis","sha256":"34100015b0ba37489e9dd70d0c7a246b183ecaeb11ee9aeea197922915433201","import_time":"2026-01-22T19:39:15.536150376Z","modified_time":"2026-01-22T19:16:06Z","versions":["1.0.17"]},{"source":"ossf-package-analysis","sha256":"43b84c3ddb9c30dfe6860ac38e3771ba6a9fd0478e3d16dcb39c340a524298b5","import_time":"2026-01-22T19:39:15.710819514Z","modified_time":"2026-01-22T19:35:54Z","versions":["1.0.19"]},{"source":"ossf-package-analysis","sha256":"70bfbe5be9f3bb2fdb58474beb0aee2cacde9bd59ea518de5ed291eb7270b4f2","import_time":"2026-01-22T20:08:05.159991024Z","modified_time":"2026-01-22T19:55:29Z","versions":["1.0.22"]},{"source":"ossf-package-analysis","sha256":"2469f8a646b986709263e1d49dc00ead1623d19bac17e3288eed4f8480ee121a","import_time":"2026-01-22T20:42:32.633062688Z","modified_time":"2026-01-22T20:22:45Z","versions":["1.0.24"]},{"source":"amazon-inspector","sha256":"1048ec8371fbc694883c71f227674b6b7ba3dcf534b1ed096ce4342a6e129920","import_time":"2026-01-23T01:36:52.478493641Z","modified_time":"2026-01-23T01:13:12Z","versions":["1.0.2","1.0.1","1.0.10","1.0.7","1.0.11","1.0.14","1.0.17","1.0.19","1.0.22","1.0.24"]}]}}