MAL-2026-2953

    Dashboard / Malicious Package / MAL-2026-2953

    MAL-2026-2953

    Published: 20 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in bmg-web (npm)

    Details: Source: amazon-inspector (26777925b4f8e199b125a969ad8c6f4e0ff672b87613b22ce2b67fe461ba218e) The package bmg-web was found to contain malicious code. Source: ossf-package-analysis (27618387221affefb03509d50b0545c22b6d18574bc71aa6f218350ca5f1528e) The OpenSSF Package Analysis project identified 'bmg-web' @ 999.99.9 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: bmg-web

    Purl: pkg:npm/bmg-web

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.99.9