@depro0x/despicable-me

{"modified":"2026-02-23T04:21:31Z","published":"2026-02-12T20:40:54Z","schema_version":"1.7.4","id":"MAL-2026-873","summary":"Malicious code in @depro0x/despicable-me (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9)\nThe package @depro0x/despicable-me was found to contain malicious code.\n\n## Source: ossf-package-analysis (4615e7677b737a414d7c43332b795fe84cb5d272e491befba14d42456ae28cfc)\nThe OpenSSF Package Analysis project identified '@depro0x/despicable-me' @ 11.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"@depro0x/despicable-me"},"versions":["8.0.0","14.0.0","9.0.0","11.0.0","13.0.0","16.0.0","6.0.0"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"6462180066b4c25e184d616993e44ba94d6e6fdf065db3e0e6ce52a1015a0aa0","import_time":"2026-02-12T20:46:27.750833393Z","modified_time":"2026-02-12T20:40:54Z","versions":["8.0.0"]},{"source":"ossf-package-analysis","sha256":"408ee2d3c535747e02e11f32f8a20bafa12ddc1ac413c41dc80ed7375e926b02","import_time":"2026-02-12T21:13:09.941100803Z","modified_time":"2026-02-12T21:04:06Z","versions":["14.0.0"]},{"source":"ossf-package-analysis","sha256":"e5e59fdbcd5eae4cddc95424e34ba5de09ae15fd2d265fcf832a68c4c4495a4a","import_time":"2026-02-12T21:13:09.774236826Z","modified_time":"2026-02-12T20:47:18Z","versions":["9.0.0"]},{"source":"ossf-package-analysis","sha256":"4615e7677b737a414d7c43332b795fe84cb5d272e491befba14d42456ae28cfc","import_time":"2026-02-12T21:45:29.334645302Z","modified_time":"2026-02-12T21:37:57Z","versions":["11.0.0"]},{"source":"ossf-package-analysis","sha256":"9d4f645b4e971818c96437326820425423bc5c41700995b66b0a6d96d110f145","import_time":"2026-02-12T21:45:29.187884531Z","modified_time":"2026-02-12T21:29:31Z","versions":["13.0.0"]},{"source":"ossf-package-analysis","sha256":"cfd0bd7743a9548666d2cb6e0bbe7392bde2f52356f29403ba18b846c2f6c8d0","import_time":"2026-02-12T21:45:29.076722365Z","modified_time":"2026-02-12T21:21:01Z","versions":["16.0.0"]},{"source":"ossf-package-analysis","sha256":"3fc28a0966ecc924884cf1cd6a75caf42b173878d6934a7f4774e294fba62ccd","import_time":"2026-02-12T22:45:32.411452612Z","modified_time":"2026-02-12T22:19:52Z","versions":["6.0.0"]},{"source":"amazon-inspector","sha256":"0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9","import_time":"2026-02-23T04:19:45.059722132Z","modified_time":"2026-02-23T03:51:30Z","versions":["8.0.0","14.0.0","9.0.0","11.0.0","13.0.0","16.0.0","6.0.0"]}]}}