MAL-2026-2987

    Dashboard / Malicious Package / MAL-2026-2987

    MAL-2026-2987

    Published: 22 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in @bmg-web/bmg-external-link (npm)

    Details: Source: amazon-inspector (6373b00808251dd64521cfb1864a0bf382c5df23e976984dea8dbebf925bbb63) The package @bmg-web/bmg-external-link was found to contain malicious code. Source: ossf-package-analysis (c90f21812ea920a529792be2cb58fac49a67f8c820098a263a2c88a8f2c56097) The OpenSSF Package Analysis project identified '@bmg-web/bmg-external-link' @ 999.9999.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @bmg-web/bmg-external-link

    Purl: pkg:npm/%40bmg-web/bmg-external-link

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.9999.99
    MAL-2026-2987 | CVE-DB