MAL-2026-2497

    Dashboard / Malicious Package / MAL-2026-2497

    MAL-2026-2497

    Published: 6 Apr 2026Last Modified: 7 Apr 2026

    Summary: Malicious code in commerce-utils (npm)

    Details: Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall. Source: amazon-inspector (3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6) The package commerce-utils was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KNFFV2J9TJFEVM7P4RHQZQBY

    Affected packages

    Package

    Name: commerce-utils

    Purl: pkg:npm/commerce-utils

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions