MAL-2026-780

    Dashboard / Malicious Package / MAL-2026-780

    MAL-2026-780

    Published: 6 Feb 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-3r8h-4c8r-pmq7

    Summary: Malicious code in ac-element-engagement (npm)

    Details: Source: amazon-inspector (781104558212062e46f87c009a2a0af57fb00f707c878b53dfc5a7c241cce06b) The package ac-element-engagement was found to contain malicious code. Source: ossf-package-analysis (eef247e16d151ebee82664252e941779eb47a9459bac9c66753fff360c19536f) The OpenSSF Package Analysis project identified 'ac-element-engagement' @ 3.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

    References: https://github.com/advisories/GHSA-3r8h-4c8r-pmq7

    Affected packages

    Package

    Name: ac-element-engagement

    Purl: pkg:npm/ac-element-engagement

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    3.0.1
    MAL-2026-780 | CVE-DB