MAL-2025-49349

    Dashboard / Malicious Package / MAL-2025-49349

    MAL-2025-49349

    Published: 4 Nov 2025Last Modified: 9 Nov 2025

    Summary: Malicious code in pkg-with-optional (npm)

    Details: Source: amazon-inspector (0a7273cf1aeda44bb1d1c2b9e1336bae21d1e1c6606ec940757a218d7761a81b) The package pkg-with-optional was found to contain malicious code. Source: ossf-package-analysis (67529e27c76b444d9c357cc28d010a783ce87fab9eec7a8ca37590e01bcdf9bf) The OpenSSF Package Analysis project identified 'pkg-with-optional' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: pkg-with-optional

    Purl: pkg:npm/pkg-with-optional

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0
    MAL-2025-49349 | CVE-DB