MAL-2026-3412

    Dashboard / Malicious Package / MAL-2026-3412

    MAL-2026-3412

    Published: 10 May 2026Last Modified: 12 May 2026

    Summary: Malicious code in post-purchase-bundler (npm)

    Details: Source: amazon-inspector (3a33aa69ef958573a786f3db208d8ee335829e14009d1fdafecbc842ed493b8b) The package post-purchase-bundler was found to contain malicious code. Source: ossf-package-analysis (6ee91ffff812d05531df7ad59d39eb10a0db8bf0ed97263701d772f4a5429e60) The OpenSSF Package Analysis project identified 'post-purchase-bundler' @ 99.9.25 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: post-purchase-bundler

    Purl: pkg:npm/post-purchase-bundler

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.9.9
    99.9.25
    MAL-2026-3412 | CVE-DB