{"schema_version":"1.9.2","id":"MAL-2025-14109","published":"2025-08-14T18:52:04Z","modified":"2026-10-29T14:45:05.188317121Z","summary":"Malicious code in adorn (npm)","details":"The package adorn was found to contain malicious code.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a)\nNo install-time or import-time behavior of concern was observed in this package version. No lifecycle scripts performing network fetch or shell execution, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment-variable scraping, no hardcoded attacker-controlled network destinations, no obfuscated payloads, and no silent-relay of caller-supplied data were identified.\n","affected":[{"package":{"name":"adorn","ecosystem":"npm","purl":"pkg:npm/adorn"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.1.0","0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"adorn-0.1.0.tgz","hashes":{"sha1":"687bf58e85cacd8f4357ad1bcf66b9417de9a469","sha512_sri":"sha512-dzMURzEkao4rVH7aIa5Q32yI36xwwW9usovindp4ot6aEQNbZYUGGF1+6UGtKgloiws0GDX9OR7wkiNo0OhFcg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/adorn/MAL-2025-14109.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/adorn/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/adorn/v/0.1.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022327","import_time":"2026-10-29T14:37:04.04850611Z","modified_time":"2026-10-29T14:18:26Z","sha256":"2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-022325","import_time":"2026-10-29T14:37:03.964491023Z","modified_time":"2026-10-29T14:18:08Z","sha256":"e599d9e6ee3f5d7eb08a02b4dded1fe4a169ac106e857aeee90f7ad162a52913","source":"amazon-inspector","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}