MAL-2026-2981

    Dashboard / Malicious Package / MAL-2026-2981

    MAL-2026-2981

    Published: 22 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in @bmg-web/bmg-button (npm)

    Details: Source: amazon-inspector (b59b2c3d1c98e7a5f4faae9549ed4f302c9273e1efeaee63e70f3013300327c2) The package @bmg-web/bmg-button was found to contain malicious code. Source: ossf-package-analysis (2458f054b53c52df146431a280cde6916e39f77fcc49e0bfaa2817b9a5f438e1) The OpenSSF Package Analysis project identified '@bmg-web/bmg-button' @ 999.999.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @bmg-web/bmg-button

    Purl: pkg:npm/%40bmg-web/bmg-button

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.999.99
    MAL-2026-2981 | CVE-DB