MAL-2026-2413

    Dashboard / Malicious Package / MAL-2026-2413

    MAL-2026-2413

    Published: 24 Mar 2026Last Modified: 7 Apr 2026

    Summary: Malicious code in cclr-component-resources (npm)

    Details: Multiple evidences suggest this package is a malware: code obfuscation, dynamic code execution, suspicious domain, and unusual install script. Source: amazon-inspector (61af3265fce06cfbb9bbf20e38d468e136487f69c41f70b0bbb1b331535bdf82) The package cclr-component-resources was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KMABV7VST8P9V153ZGTCA5MB

    Affected packages

    Package

    Name: cclr-component-resources

    Purl: pkg:npm/cclr-component-resources

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions