{"id":"MAL-2025-49247","revision":"c7ad088bb9d84edc9db677a394fc6357","records":[{"revision":"c7ad088bb9d84edc9db677a394fc6357","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2025-49247","aliases":[],"title":"Malicious code in siren-lament (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9f9146581b28381099b9aea208feeb40077658b468ce7897143988b86a5ec23b)\nThe package siren-lament was found to contain malicious code.\n\n## Source: ossf-package-analysis (092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f)\nThe OpenSSF Package Analysis project identified 'siren-lament' @ 2.14.827 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","state":0,"publishedAt":"2025-10-29T22:29:06+00:00","modifiedAt":"2025-10-31T02:37:09+00:00","affected":[{"ecosystem":"npm","name":"siren-lament","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":["2.14.827","2.14.822","2.14.824"],"rawVersionEvidence":null}],"metrics":[],"references":[],"sourceUrl":"https://osv.dev/vulnerability/MAL-2025-49247","license":"OSV · upstream source license applies","key":"osv:MAL-2025-49247","identifiers":["MAL-2025-49247"]},"retained":false,"historicalAffected":[]}],"coverage":[]}