MAL-2026-2870

    Dashboard / Malicious Package / MAL-2026-2870

    MAL-2026-2870

    Published: 8 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in black-moon-js (npm)

    Details: Source: amazon-inspector (7c672e4ab8770773551a9ff9b6b95a5740894bd1c689154056f69e5da4fdb879) The package black-moon-js was found to contain malicious code. Source: ossf-package-analysis (07326967481888114f050ef0f2a43c190f06203311ed9826b734f9855dbbf373) The OpenSSF Package Analysis project identified 'black-moon-js' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: black-moon-js

    Purl: pkg:npm/black-moon-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-2870 | CVE-DB