{"id":"MAL-2025-49247","revision":"1bfb4bd5edb74780be6672e967fd3379","records":[{"revision":"1bfb4bd5edb74780be6672e967fd3379","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2025-49247","aliases":[],"title":"Malicious code in siren-lament (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8)\nThe package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a placeholder or staging publish rather than a functional library. No code paths that would compromise an installer on npm install or require() were identified.\n\n## Source: ossf-package-analysis (092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f)\nThe OpenSSF Package Analysis project identified 'siren-lament' @ 2.14.827 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","state":0,"publishedAt":"2025-10-29T22:29:06+00:00","modifiedAt":"2026-10-29T14:30:45.5952648+00:00","affected":[{"ecosystem":"npm","name":"siren-lament","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":["2.14.827","2.14.822","2.14.824","0.0.0-stage"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/siren-lament/v/0.0.0-stage"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2025-49247","license":"OSV · upstream source license applies","key":"osv:MAL-2025-49247","identifiers":["MAL-2025-49247"]},"retained":false,"historicalAffected":[]}],"coverage":[]}