MAL-2025-190585

    Dashboard / Malicious Package / MAL-2025-190585

    MAL-2025-190585

    Published: 20 Nov 2025Last Modified: 24 Nov 2025

    Summary: Malicious code in expertsvc-onboard-offboard (npm)

    Details: Source: amazon-inspector (fd6d7a1267ed4ecc6a46b548be6778e2f198c0ec5629953d3e9e6a79e1f213df) The package expertsvc-onboard-offboard was found to contain malicious code. Source: ossf-package-analysis (756a908558c34a29a778fb8ede3ad7f9a4ffec733d3e6dc28169c70e65908381) The OpenSSF Package Analysis project identified 'expertsvc-onboard-offboard' @ 12.124.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: expertsvc-onboard-offboard

    Purl: pkg:npm/expertsvc-onboard-offboard

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    12.124.0
    MAL-2025-190585 | CVE-DB