MAL-2026-2701

    Dashboard / Malicious Package / MAL-2026-2701

    MAL-2026-2701

    Published: 16 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in sanitize-url (npm)

    Details: Source: amazon-inspector (36f98260cc1b910a8921671795398ad7f986f02b0b7bc8efef18a4df09b87d51) The package sanitize-url was found to contain malicious code. Source: ossf-package-analysis (0614e2498dbee5c3133dc2dff5457f14cd9f7cd1ec54ac26a035f895c396bbfa) The OpenSSF Package Analysis project identified 'sanitize-url' @ 8.9.9 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

    References:

    Affected packages

    Package

    Name: sanitize-url

    Purl: pkg:npm/sanitize-url

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    8.9.9
    MAL-2026-2701 | CVE-DB