MAL-2026-168

    Dashboard / Malicious Package / MAL-2026-168

    MAL-2026-168

    Published: 8 Jan 2026Last Modified: 15 Jan 2026

    Summary: Malicious code in @zuora-marketing/linting (npm)

    Details: Source: amazon-inspector (ddcfd1151af868e694a4a79307ce1284331ad88b8ff631651f3fd2c47fbf342a) The package @zuora-marketing/linting was found to contain malicious code. Source: ossf-package-analysis (02e59dfc0bb58f27949258caefffd5c13d5c3af111b8c069edf5ea6e0e985f22) The OpenSSF Package Analysis project identified '@zuora-marketing/linting' @ 5.1.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

    References:

    Affected packages

    Package

    Name: @zuora-marketing/linting

    Purl: pkg:npm/%40zuora-marketing/linting

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.1.0