MAL-2026-48

    Dashboard / Malicious Package / MAL-2026-48

    MAL-2026-48

    Published: 5 Jan 2026Last Modified: 8 Jan 2026

    Summary: Malicious code in shop-state (npm)

    Details: Source: amazon-inspector (5afad53032ae0acf7c8b481c6f0bd05fc4a1c283de24285d35b19a376cfa1b10) The package shop-state was found to contain malicious code. Source: ossf-package-analysis (d58739af4e37d5036dbdce18541280d73164818a82e7d2de5f2b142a52db2a89) The OpenSSF Package Analysis project identified 'shop-state' @ 999.1.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: shop-state

    Purl: pkg:npm/shop-state

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.1.0