MAL-2026-3404

    Dashboard / Malicious Package / MAL-2026-3404

    MAL-2026-3404

    Published: 9 May 2026Last Modified: 12 May 2026

    Summary: Malicious code in @matjp/dvi-decode (npm)

    Details: Source: amazon-inspector (285904d13f5d698c3c33461fe969265ca73c3041db80eabe5637c1ebd3f3ca9b) The package @matjp/dvi-decode was found to contain malicious code. Source: ossf-package-analysis (b308cd4e6d4c434c8a74fa1c1a14f354498072da7c7d3e7ab790766b11828a17) The OpenSSF Package Analysis project identified '@matjp/dvi-decode' @ 0.4.101 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @matjp/dvi-decode

    Purl: pkg:npm/%40matjp/dvi-decode

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.101
    MAL-2026-3404 | CVE-DB