MAL-2026-56

    Dashboard / Malicious Package / MAL-2026-56

    MAL-2026-56

    Published: 5 Jan 2026Last Modified: 8 Jan 2026

    Summary: Malicious code in @crepo/crepo-url-query-mapper (npm)

    Details: Source: amazon-inspector (a8556f30a48d0b1c957d0d66394801c28e6259503ed20f4cbf900102b962ee5f) The package @crepo/crepo-url-query-mapper was found to contain malicious code. Source: ossf-package-analysis (add65bf82139a3279aa3da202fe92d6d36da30975e56567399ec3eaa82f4f76d) The OpenSSF Package Analysis project identified '@crepo/crepo-url-query-mapper' @ 11.11.12 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References:

    Affected packages

    Package

    Name: @crepo/crepo-url-query-mapper

    Purl: pkg:npm/%40crepo/crepo-url-query-mapper

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    11.11.12
    MAL-2026-56 | CVE-DB