MAL-2026-3348

    Dashboard / Malicious Package / MAL-2026-3348

    MAL-2026-3348

    Published: 5 May 2026Last Modified: 12 May 2026

    Summary: Malicious code in @rivianlabs/bedrock (npm)

    Details: Source: amazon-inspector (7d12061e491ebc9109496b77ffd62384bba9a781ac9f0579343a61c5742df351) The package @rivianlabs/bedrock was found to contain malicious code. Source: ossf-package-analysis (be028dadb5642a37a73b040b641fb6070be0adf328c27437477f4c5ddb64ec7a) The OpenSSF Package Analysis project identified '@rivianlabs/bedrock' @ 0.0.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @rivianlabs/bedrock

    Purl: pkg:npm/%40rivianlabs/bedrock

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.2