MAL-2026-4659

    Dashboard / Malicious Package / MAL-2026-4659

    MAL-2026-4659

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in rdflib (npm)

    Details: Source: amazon-inspector (fb9a536a077e23bda8e10a55aa1177de28f4f5a8622e08914eeab437e8036940) package.json for this release declares two runtime dependencies — "package-lock.json": "^1.0.0" and "package.json": "^2.0.1" — inside the dependencies block. These are bare names that npm resolves from the public registry, not local files. Neither name is required or referenced anywhere in the rdflib source, so they serve no functional purpose for the library. Their only effect is that running `npm install [email protected]` will fetch and install those two third-party packages and execute any of their lifecycle scripts on the installer's machine. The names are confusingly chosen to mimic standard npm artifact filenames, which obscures the dependency injection during casual review of package.json. This pattern is consistent with a hijacked/tampered release pulling attacker-controlled transitive code into the installer's dependency tree under the cover of a trusted package name (rdflib).

    References: https://www.npmjs.com/package/rdflib/v/2.3.7

    Affected packages

    Package

    Name: rdflib

    Purl: pkg:npm/rdflib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.7
    MAL-2026-4659 | CVE-DB