{"id":"MAL-2024-10584","summary":"Malicious code in yarn2nix (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (926aa0eee20951e4172e721ccd2f312b8bf8b7f4618dd28b4f54cde9acdc76d8)\nThe OpenSSF Package Analysis project identified 'yarn2nix' @ 1.3.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2024-11-12T04:36:44Z","published":"2024-11-12T04:27:58Z","database_specific":{"malicious-packages-origins":[{"import_time":"2024-11-12T04:36:18.89287129Z","modified_time":"2024-11-12T04:27:58Z","sha256":"926aa0eee20951e4172e721ccd2f312b8bf8b7f4618dd28b4f54cde9acdc76d8","source":"ossf-package-analysis","versions":["1.3.4"]},{"import_time":"2024-11-12T04:36:18.979850162Z","modified_time":"2024-11-12T04:30:47Z","sha256":"b21cb25d30a3df59e1675be0770886f885a2912c1a4a8d4adaba0fd7347e86fd","source":"ossf-package-analysis","versions":["1.3.5"]}]},"affected":[{"package":{"name":"yarn2nix","ecosystem":"npm","purl":"pkg:npm/yarn2nix"},"versions":["1.3.4","1.3.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yarn2nix/MAL-2024-10584.json"}}],"schema_version":"1.9.0","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}