{"schema_version":"1.9.2","id":"MAL-2026-18322","published":"2026-10-26T02:39:49Z","modified":"2026-10-29T14:30:44.660746035Z","aliases":["GHSA-682c-pwqm-7gxv"],"summary":"Malicious code in numbors (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9965eb6c2b7018707d2ca2ea1840355875eec43f0fc1efb9f03b45cf0566e1a)\nThe numbors npm package publishes its entire shipped surface as heavily obfuscated JavaScript: every file under dist/ (the main entry dist/mcp.js, dist/config.js, dist/format.js, dist/command-catalog.js, dist/surface-parity.js, and ~90 command modules under dist/commands/) is minified with hex-identifier obfuscation (_0x<hex> variable names) rather than readable source. The package appears to be a CLI/MCP tool covering accounting, CRM, payroll, POS, and billing operations against a backend service. No concrete installer-harm fingerprint is visible from the shipped artifact — no lifecycle scripts fetching remote payloads, no identified credential-store reads, no hardcoded attacker C2, and no identified exfiltration path were observed — but the uniform obfuscation across every shipped file prevents semantic verification of what the CLI does when invoked, including how it handles any API tokens or financial data a user provides.\n\n## Source: ghsa-malware (287297439c9bdf199a88d43f3722ab361fde262c2ff3ee0f813fff21275211db)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"numbors","ecosystem":"npm","purl":"pkg:npm/numbors"},"versions":["1.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/command-catalog.js","sha256":"8266829c4a965a620b94254d8f6924b180584d30df54ad84b7205b5d47be05fe","tlsh":"9bd3e5e41784d147a29d4743ff0abae9f42aa8a175c4a907c294bbbd3cb9107d274ce1"},{"path":"dist/commands/account.js","sha256":"824798cc177cf2993e813273e13986a20e9e9a3ba4334898761983b0619966d8","tlsh":"afe27bd437c0e50376ce5ba3bf12b9d8e12ba8b6a8c4a40782647a9d64bc517d1f0df4"},{"path":"dist/commands/actions.js","sha256":"f93a874530bad2e09be87348dcb3919326f5e99ae268ff24131bb46e52712695","tlsh":"3cd29cd477c4e40366cd1ba3bf16bae9e06ab87279cca90792547a9c64b8507c1f0df0"},{"path":"dist/commands/activity.js","sha256":"b211a34da808526c93aede76863145f9414e73115a943574d602c0bbcda14fbd","tlsh":"85237cd437c1e403a6ce0b63bf05bad8e47aac7269c8a54782a07a9c34b9517c5f4df4"},{"path":"dist/commands/article.js","sha256":"d07bdc559f755deb19a09cccbde6ef9c2dc2a4e1e548ef65fd7d7576553d3ed3","tlsh":"21236ad42780e40366cd1ba3bf02b9e9e16bbcb569c8a94782647a9c747c613d1f4df0"},{"path":"dist/commands/asset.js","sha256":"62c0bf153cec529b8c94063684c9a30aa8ea253dad7ddea779fa92bbafd2e7cd","tlsh":"32738cd46780e40366cd0b63bf06bdf8e03aa8b269c8e94786547a9c78bc517d1b4df4"},{"path":"dist/commands/audit.js","sha256":"f744e430fe413a1d5185fb7df9c0c7647cdf9a5cd8d752298abb127d58ae4933","tlsh":"3042819467c0e403a7cd0f53bf16bde8e12bac7569c4a54b96107aac687c917c2e4ef0"},{"path":"dist/commands/auth.js","sha256":"a5ebf2f5ba5e5b92cd8b63c353753d87668f640ca16663f84208e3a764adc02c","tlsh":"41e269d03780e407a2cd0b63bf16b9ece02fa8b169c8a54796647adc68bc517d1b0df4"},{"path":"dist/commands/bacs.js","sha256":"7e08a61a3c9b57eb0942fbd08c85f6bc803f56f488df4fa816048796f843405f","tlsh":"572357d46790e003a6cd0aa7bf06f9e8e53bb87678c8a5479264799c74bc017d2b4df0"},{"path":"dist/commands/bank.js","sha256":"68acba57506acc18cfbbfc3acc57ae5bff2c153b50b252fcbc79265363e9d35d","tlsh":"6a836b946bc1e803a6cd1ba3ff02b9f8d07bb8b265c8a54386547a9d68bc117d170df4"},{"path":"dist/commands/bill.js","sha256":"ed7885be67037613afb9690d1b703e6670035e32f581c5730ac2dfc4b77adb7e","tlsh":"28337cd427c0e00366ce0b63bf16bee9e07bb9b278c4a90796547a9d64b8517d5b0cf0"},{"path":"dist/commands/budget.js","sha256":"8152272e681fa49b4dde19ac9e6343c8389daf706048622767931efeeca5c3bd","tlsh":"93a2aae437d1e40372cd5b63bf12b9e8e46aacb278c4a54786547a9ca8b8107d1f1df0"},{"path":"dist/commands/calendar-group.js","sha256":"afc678c2298258cf707c8760c623b46f786eb9000bd678c46959e42829ebcdb0","tlsh":"c31376d467c0d40372ce4b63ff06b9e8e56ea8b568c8a94792547a9c74bc10bd5b0ef0"},{"path":"dist/commands/calendar.js","sha256":"7c835befa400003f4725b7d8ab7c0f157b051821c7a6919a8b2ce562e1b06f03","tlsh":"951359d43780e503b6cd0b63bf16b9e9e02ba8b678c8a94782547b9c64bd517c1b4df0"},{"path":"dist/commands/campaign.js","sha256":"7f55f8b47b59aa74ba2ba943e0703d0285d867168c7c34d97764cf6ba0a8d1e6","tlsh":"ba2379d427c0e403668e1b93ff12b9e9e03bacb569c8a50786647a9c78b8517d5f0df0"},{"path":"dist/commands/cap-table.js","sha256":"1122083e5f10a4cad44458a3d52d0b54f9537d16ee9a3b058201bacc8875cfaf","tlsh":"36738ce46bc0e407628d1b53bf06b9e8e03bb8b269c8b40786647a9c74bd157d5b4df0"},{"path":"dist/commands/categorize.js","sha256":"5415a05fc2163664655ea7d75f9b73a225e8d39ae99e36edcf5aa8c538b9f327","tlsh":"04138cd427c0e407b6cd5b63bf02b9f8e53fb9a1a888a54b9190769c68bc517d1b0df0"},{"path":"dist/commands/claim.js","sha256":"f017201765cf27a1fb09d88d2fde658a30e2ca905009dbfbc399ba862e5b1bc1","tlsh":"63b2bfd427c0e50376cd1b63bf12b9e8f02ba8b669c8a447c254ba9c68bc507d5b4df4"},{"path":"dist/commands/close.js","sha256":"b25ae41d33b57169d6b36a48d2b47771131b9786939309b1d427fd2b461ba854","tlsh":"20237cd427c0d40366cd1b53ff12b9ede62fa8a2b4c8a847926076ad647c547c6b0ef4"},{"path":"dist/commands/coa.js","sha256":"ddc9566ce90ac0e12cd5c19033fdd74990fed28e7bd408782b9801b668bba0d6","tlsh":"a5c2ab9427d0e90361ce4b93bf03b9e9e06ea87669c4a407c160badd78bc11bd5b4df4"},{"path":"dist/commands/collection.js","sha256":"dccea282d794d9bf66b53f4f49d96f41fbead9ecbc76b03c9e5028c2b2281a03","tlsh":"81236fd437c1e40366ce5a93bf02b9e9e13facb275c8a8079254769ca8b8517d1b4df0"},{"path":"dist/commands/companies.js","sha256":"50a1cd942fbe7b87ec676b0fa79d9afa8f6cff5119a7f3b0f0ae3e5e0293c0b4","tlsh":"5f329e9877d0e403628e5f93bf0679f8e42aac7979c4a94b92547adc68b8417c1f0df0"},{"path":"dist/commands/contact.js","sha256":"7b65e9e5c4b5a3e40db7f4d8fcb1a359048af7f9ee75086180a24aaab2746d2a","tlsh":"df1378d427c0e403a69e0b63bf05bae8f07aacb678c8e507d5547a8c68b9517c5b0df4"},{"path":"dist/commands/contract.js","sha256":"ed0d1a955641de1605b7c1a4aa541961673c921b070bb4c2d7ac15af6c052ee1","tlsh":"85d379d42780e40762cd1ba3bf127eede13aa87679c8a50782647a9c38bc517d1b4df4"},{"path":"dist/commands/cosec.js","sha256":"2e2c4201dcf785d31bc70245d53635910a3d41ac66cec7db42af96eb2eb98b97","tlsh":"54f279d427c4e40366ce0b63bf02bdf8e42ab8b269c4a9479650baac747c517d1b4df0"},{"path":"dist/commands/credit.js","sha256":"1f06b4929998d4ef6bf49f2fd662682b3a4141dc8e79fa4c08c549da624f7033","tlsh":"4b337ad437c0e80762ce0b63bf0679ece07aa87269c8a94792547add74b851bd1b0df4"},{"path":"dist/commands/crm-company.js","sha256":"20270681d2006e4b414377e3effa3f08bdbb7e883bc07a405271b5e5130f2569","tlsh":"b9f27ce467c0e40362ce1b63ff1679e9e03ba8b679c8a947a254769c24bc457c1b4df0"},{"path":"dist/commands/crm-contact.js","sha256":"7e3804cd0a16619765a9f653e2d6139f22930e424ce2d1666b38c0918a151dc7","tlsh":"1413a99427c0e407a6ce4ba3ff16bde8e03ba8b569c4a90786547a9c64bd507c1f0df4"},{"path":"dist/commands/deal.js","sha256":"04c97ac3455cd223bc1832d9c2286106ee7553d69b5b85398286d2d02b68381e","tlsh":"9423aad427c0e403a68e0b63bf02bde4e07bb87269c9a5479264b6dc68bd517c1b0df4"},{"path":"dist/commands/debit.js","sha256":"ad469cc5dbfedcc74f42dda1cd5d1971b0e5725693c66a805d0761839ccaf971","tlsh":"60334ad467c4e80362cd1b53ff07bae9e02aa8b279c8a94792547a9d74bc507c1b4df0"},{"path":"dist/commands/do.js","sha256":"f7ff1caa0eedaca7020f8c6ee4d9cde414d22f9fc655491e447d063bc029336d","tlsh":"4c629ad83790d44776cd1a43bf16beece42aacb2a9c4a44be754769c64f8017c1a0ef0"},{"path":"dist/commands/employee.js","sha256":"a26896c42c2c0f0ba05c9e458d340105e0d8305f0c02710c1cb26e2dddcbaade","tlsh":"6a3389d467c0f403a6ce0b63bf01bae9e13bad7269c8a50396507a9d68bc517d1b0df4"},{"path":"dist/commands/estimate.js","sha256":"5e7a8f05cb831c6c95db8cf6ed6d07a1676df3faa6a29426222f4366e38189ad","tlsh":"a56389d427c1e40366cd1ba3ff02b9e9e17ba87279c8a5078254ba9d64bc417d6b0df0"},{"path":"dist/commands/expense.js","sha256":"a8da4725f2bbcdedfa1d1b258957bc2a690d452ddc3423775559255305e425c6","tlsh":"636269d43b84e40376ce0ba3bf11bde8e52ba876bdc8a4078658769d64b9417c1b0df4"},{"path":"dist/commands/filing.js","sha256":"1ffb201e9b6c4a7fc4bfc373c0d5d877d507cb2d78cfa6043269a5edf78c1d9d","tlsh":"17237ad467c0e40762ce1b63bf12b9ece02fa8b169c4a54782607a9c78bc517d2b4df4"},{"path":"dist/commands/forecast.js","sha256":"1e17cc292c2a693700c150f576c14ef93e3f70c02e81832dacf74a3f1a5db590","tlsh":"51d27a947b85e053b3ce1a93bf06b9e8e42becb176c4a40792547aac64bc017d5b4df0"},{"path":"dist/commands/health.js","sha256":"ecfe1321ce3e7b86f58b6a5cd50c7e463a627c6a2c3c4a2e4a60ccab55e875b8","tlsh":"ca3292c053d0d807628e4fa7bf1675e9e03beca275c8a9079254769ca8b8417d2f0df4"},{"path":"dist/commands/init.js","sha256":"6f8d2c728535ab4daa260691985421fec44713ca50a3911567d75716b7635ae0","tlsh":"edb3f7d4a7c5d003a2ce0763ff06baede03aa87668c8f50796907a9c287c517d5b1de4"},{"path":"dist/commands/insights.js","sha256":"f22f4cc3edb92de6cc2e23ae680e52cd5d1a2b15359ce25386885e4b403afdd2","tlsh":"5bb279d02785e40766cd1ba3bf0af8f9e16af87178c8e90796647a9ca478503d1b4df0"},{"path":"dist/commands/invoice.js","sha256":"2a516343a3cd0d07926d33c50a1e5056fd999420d4ac38d22240575cc9d9e6bf","tlsh":"ce636bd427d0e403a2cd1b63bf06b9e8e07fac7668c895078294ba9d64bc517d2b4df4"},{"path":"dist/commands/item-group.js","sha256":"f8654bf99abbbc6505a20423f937c912bbbb7560102aacc17e1749e9e23cbe5f","tlsh":"0e238ed426c0f80765ce1b63bf12bdece46aac7269c8a947816476dc74b8517c1b0ef4"},{"path":"dist/commands/item.js","sha256":"a67e7eb4ae2e64d966b71a85a6c0a674860ab926fc288379dcbd089f0724dc72","tlsh":"de1389d46780e403a6ce0b63bf12bde8e03ba8b66cc8a54395547a9c74be517d1b4df0"},{"path":"dist/commands/journal.js","sha256":"40d91f9dfa7e7d2da7d2c3a0cd62a87f545d88b23bd6482c565ff51cefa1a2b3","tlsh":"7363999427c1e40376cd0ba3bf1679e9e12bacb678c8e5479264799c68bc517c2b0df0"},{"path":"dist/commands/key.js","sha256":"a9600d1f9365a45a9ee9116ac7e895481ac38ad2d5ddce4e5504af47508a82ea","tlsh":"abd2c2c46bc0d40366ce4b93ff1679e9e53ba87268c8a9079654ba9c74bc507c2b4df0"},{"path":"dist/commands/lead.js","sha256":"7151c86cd86646d62bffd2e8d72dce32c1f6d72a26c7c3f5efe06cf01f01f127","tlsh":"9d7357d467c0d40366ce0ba3bf16b9ede17facb2a9c8a5438650769c68b8507c5b4df0"},{"path":"dist/commands/mandate.js","sha256":"94eee2854fd6b833c66fa14424ecff5fbdd6bbf7555bedc450adc79a42f6c3bb","tlsh":"ab3359946780e40766ce1b93bf02baf9e07bacb574c8a9478264769d64bc50bd1f0df0"},{"path":"dist/commands/migration.js","sha256":"3e45d263a6f699268a6468f2fc030301fdb79e2552672e0d786f6b3008c54741","tlsh":"c57289c427c0e403b6ce4b63bf02bdd9d12ae8b6b9d4a54b56543a9d38bc507d2a0df4"},{"path":"dist/commands/option-pool.js","sha256":"ccef02e220bfc4e44ba0c19f208160b0c9ae3aa002000e053a3ae7d86fbf5876","tlsh":"c20389d06790e40365cd0ba3ff12f9fde46bacb268c8a54782547a9c68b8517c5b0ef4"},{"path":"dist/commands/order.js","sha256":"a653f01fe25644095faa23c2eaf1c593ff9235a280bbc1d997502ec31f64bfbc","tlsh":"c8539cd467c0d40362ce0b63bf06bde8e13ba97279c4a947d260ba9d68b8417d5b0df4"},{"path":"dist/commands/outreach.js","sha256":"2df95ba2105edb58494e72b659740b69bc056951af401208385d5cdb6b3c6fdc","tlsh":"f3139ad42790e40366cd1fa3bf12bdf8e12aac7668c4a54782a47a9c78bc517d1b0df4"},{"path":"dist/commands/pay-calendar.js","sha256":"96f6d37c19c8841ce53051115deb3fb401660ea1b6214d646c3465334bfa58ab","tlsh":"b52379d477c1e40376ce0b63bf06b9ede03aa8b669c4a5439264769c28bc517c1b8df4"},{"path":"dist/commands/payroll.js","sha256":"8de4b69dbb8ecb6c3f3b9caa4118a9be52c6ec96dd104c0c75b64c64fce38929","tlsh":"86b2afd47380e517a2ce0b53bf07b9f9e12ba87265c8a907825076dc68bc51bd5b4df0"},{"path":"dist/commands/payslip.js","sha256":"185948fba07c6790a9bae6a0560225cb3e947a40a98f11529cf9af416b9bc436","tlsh":"9bf27f946781e40362ce4b63bf067de8e53aac7278c8a90786647adc78bc517d1b0df4"},{"path":"dist/commands/pipeline.js","sha256":"6f51e1a7e20cf89ac307e6eea736171ce6457539ddf269bb12803523e8d9404d","tlsh":"afc289d427c0d40362ce0b63bf02baede16aadb678c4a94781247adc68b9517c5f0df4"},{"path":"dist/commands/pos-order.js","sha256":"5b25ed4517d122ff7524a60230af1bb10528c26a4f6643e42e738d13ff58c44d","tlsh":"78037bd42b80e40766cd0b67ff02bde9e02ee9b279c4a50b915476ac68bc457d1b4ef0"},{"path":"dist/commands/pos-report.js","sha256":"a30880a5f0b92fd89556bae78a5a00cd797b784031d38358d1f4e299fe233293","tlsh":"c8a26c9427c0e507768f5b63bf12bae8e13a687279c4a547962477dc78b8217c2b0df0"},{"path":"dist/commands/pos-session.js","sha256":"0d882dada17189cf508b219ff61966250a37b33eee11ff89a98a07a09cf7ca08","tlsh":"01237c947780e50366ce1b63bf16b9ece02fac7679c8a40b9250ba9d687c507d1b0df4"},{"path":"dist/commands/pos-terminal.js","sha256":"b9ca1aa38613e3eaafa7487d8644d12dc8c274c210c7e3784029a93b354831e5","tlsh":"a5f259c467c0f40362ce0b63bf16b9f9e42bacb579c8a44796547aac68b8507c5b0df4"},{"path":"dist/commands/project-expense.js","sha256":"d20a8feda6522f07c0fd26fdbe40b68013bd0c53d2f17b267a8dc7028ea35340","tlsh":"610359d037c0e403668d1fa3bf12b9eee46abc72a9c8a54781543a9c68bc517d5b0df4"},{"path":"dist/commands/project.js","sha256":"3c0cd25e3f2e82590851b2913d127d58f793016c797d228f7bc32dbc0d427337","tlsh":"c0437ad477c4e41366ce0ba3bf16bae9e53ba8b268c8a5078264759c74bc517c1b0df0"},{"path":"dist/commands/proposal-pipeline.js","sha256":"984daa158b37be197b23a46c11825023c7359d06642e20970ef6dffdcaa3e8c7","tlsh":"a0e269d577c0e407728e4a63bf06b9e8e12facb165c8a9039654769ca8bc217d1b0df4"},{"path":"dist/commands/proposal-template.js","sha256":"bca5a4b025269337eb04239e1dd32aa25dab0a05394c02892c30da74c82fd1f1","tlsh":"6403add43795d003768e4b67bf12bde8e42bacb669c8a44382647adc68bc507d5b0df0"},{"path":"dist/commands/proposal.js","sha256":"ac447177e53eb9c10cc08c3d57e93fde6f0a5f20adc30ff77176d3f3144ed430","tlsh":"7c3368d46b84e443a6ce0b53bf06bdece02fa87269c4a94382547a9c78bc557c1b4df4"},{"path":"dist/commands/purchase-order.js","sha256":"8f0753ae622127f69214ba2024d1c764612aab1c71997339c635769032aca275","tlsh":"c0638cd466c0e40372ce0b63bf06b9e8d47be9b179c8a90746647a9d28bc507d2b0df4"},{"path":"dist/commands/receipt.js","sha256":"ede1218bbd19a8955fe971d4a579792f178cafedf8a0d30ce97406244cb7d034","tlsh":"cfb2cd9467c0e403b2ce0ba37f0a79f8e06aac7675c4a94796947a8d78bc517c1b0df4"},{"path":"dist/commands/reconcile.js","sha256":"9243f0190242261fd5c5af0e308c14c712b5c9fc2da3249463f7e39ef0707738","tlsh":"5d227e9423c0d803a6cf4b937f1279e8d83aac61b5c8994797547aacf8b950bc1b4df4"},{"path":"dist/commands/recurring-bill.js","sha256":"1b554f2547a7cec69e77cb1a20d7d380affbb7550262906e69126fa283bf22a1","tlsh":"63437bd427c0e40366cd0ba3bf027ae9e13ba97679c8a54781647add68bc517c2b0df4"},{"path":"dist/commands/recurring-transaction.js","sha256":"8089747c64970158e6c62edb5604a50109ee3497bb168eb7d4736b3e7fd58bca","tlsh":"b04367d437c0d407668e0ba3bf167ae9e12bb87a68c8a54792547a9c38bc117c5f0df4"},{"path":"dist/commands/recurring.js","sha256":"553a2035b8899ad03b56d52b57390ba07ae8d23024acace5167dfe4e05d9c8e3","tlsh":"e8338ad477c4e40366ce0b63bf12bde8e02eac7268c8a94782547a9c64bc517d2b4df4"},{"path":"dist/commands/report.js","sha256":"3ebf93b1272ebce8d4c22644a7992e170278dc28d84f1ea55b5f29a61fafc86d","tlsh":"83e3cdd02780e407a68d4b63bf06b9e8e17bb8b669c8e94785247adc64bc517d1f0df0"},{"path":"dist/commands/sales.js","sha256":"48a169d3816ba4fb353f8edb05c7d55e1d933e80d1e49602ad88de48295c28b8","tlsh":"6f739cd427d1e00762cd0b63bf02b9ede47fa9b269c8a50b9290769c68bc517c5b0df4"},{"path":"dist/commands/settings.js","sha256":"21a0a070510814a526a6bd7c2424308ae0487847b5c970011bf1384db6b51166","tlsh":"6f9269d427d0d407728e67e7bf26b9e8e12bacb2a884e5479250779c78b8517c0b4df0"},{"path":"dist/commands/share-class.js","sha256":"c27fa79960770ae11dff7f7bc78f9817b38829a023bfa3a92c8ba6f79fe55c5c","tlsh":"6c439bd83780e403628d0ba3bf0679e9e16b78b66cc8a54786947adc28bc557c5f4df0"},{"path":"dist/commands/shareholder.js","sha256":"ff1c10d89e827341e12295e506941e46be31295136f3d3cdc718b29c6e65e327","tlsh":"e43358d467c1e40362cd1b53bf06bde9e16ba8b279c4e94792a0b69d24bc51bc1b0df0"},{"path":"dist/commands/signup.js","sha256":"e8886cd7a4e9a7b66f155387d360c40206f4a2a4fa6f1500d4fd6fdb27fe9c92","tlsh":"e5d269d46ac0e00ba1cd0b43ff01ade8d02fb87664c4a9479265769caabd957c374ef1"},{"path":"dist/commands/sla.js","sha256":"c1e652ed164564b2044845bb2f1a918b1ff319a58bef2548d636e77a56ba1d3c","tlsh":"914390d43780e40762ce0ba3bf12b9e8e16fa8b668c8a547925476ac747c507d6f0df4"},{"path":"dist/commands/stats.js","sha256":"cf9bbd9a3c6a40ad439ac9d0564b98292061328ba4c51cfd21f6eb1b3b212fe5","tlsh":"f3d278d427d0d403a6cd4ba3bf1279e8e13fa8b569c4a80b92547a9c78b8547c6f0df4"},{"path":"dist/commands/status.js","sha256":"6d7290aec591eb7194f6a48f68d4a7c30b144c1dc78fc7ca8ffe3fc32e6dd06b","tlsh":"867269902790f00366cd17a3bf02b9e8e46aa8727ac5a507d2547fac78bc517d9b0df4"},{"path":"dist/commands/stock-adjustment.js","sha256":"26eaca5b65ede5225a22d04715f881ff158c1682284e14633b585db3729c7664","tlsh":"1ef26dd42780f50366cd5f63bf06bdf9e02aa8766888a907c6547a9c78b8507c1b4df4"},{"path":"dist/commands/stock-transfer.js","sha256":"4c950aba742fa5c10366ad2de4288faf573f1fe463b24c388d6329ee856d785f","tlsh":"f72388d067c0e50766cd4b63bf02b9e8e07aa8b678c8a54782647add78bc507d1b0df4"},{"path":"dist/commands/stripe.js","sha256":"fb4c78b96f292b24b33557e41840d36081c09d73c16d9357db59f213b03cba40","tlsh":"0be2abd46bc0e41763cd5a63bf02b9e9e06b9972a8c4a407d6a07a8cb4bc517d5f0df0"},{"path":"dist/commands/task.js","sha256":"a3e1ded3c09266ba4e7a8e6816edb4a09b6aa555ebb119d02b571e89d5eb6228","tlsh":"d5339cd82780e40766ce1b53bf16b9e8e12aacb238c8b50796547adc64bc913c5f4df4"},{"path":"dist/commands/tax.js","sha256":"4d75f011505cced573c28d8d44d517d95a08cac8caadf9c465a30a1299af8801","tlsh":"89338c9467c0e40366ce0b63ff0679f8e12abca668c8a4479264b9dc78bd517d1b4df0"},{"path":"dist/commands/ticket.js","sha256":"b28e21393b2cea94fd493fd69fa23efeaf5c51b503b4124275f89ba3905d5653","tlsh":"e3337dd477c4e40766ce0b63bf06b9e9e12abc7668c8a54782607a9c74bc417c2b4df4"},{"path":"dist/commands/tickets.js","sha256":"5c9ca76fe9f9c1e1402a7357570a7a03b1b20922e6de3ff65e67fbbbdea951d1","tlsh":"418260c437c0d403668e0b63bf1679e9e12fa86779c8a90bc25476ad68b8557d1f0ef0"},{"path":"dist/commands/time.js","sha256":"5a6b26aa40cbdc32bfd1724420bb0d69c68a03eba1bca907c162e34d89b19fba","tlsh":"80236bd43781e403a6cd0b93ff02b9ede12bacb268c8a447815476ad68f9557c1b4df0"},{"path":"dist/commands/transaction.js","sha256":"fab7ac1ee280f65dff4ee89002a4007b0f3da3b82200fad7113a742084b2f893","tlsh":"04035bd427c0e40362ce0b93bf05bde9e42abc7669c8a44796647adc74b891bd1b0df4"},{"path":"dist/commands/transfer.js","sha256":"3eab171f34d8f56a864526ad1c07601d77b3ab0486847430286ae5e07669ab2d","tlsh":"0d829d8467c0e403a6cd0b53bf16b9e9e03fa8b169c4a407d654bead68bd517c6b0df0"},{"path":"dist/commands/vat.js","sha256":"957ba6b4ee1c049859e1fa58e679a1dffa8dd7982c1f9e8dfa9df47728394865","tlsh":"90738ae06780e417a6ce0b63bf1279ede17fa8b268c8a50791547adc68bc517c1b0df4"},{"path":"dist/commands/warehouse.js","sha256":"91b41bfda51be5ac0417d55da1b75f1060910bb9f1fa27107c05f54cc56540d6","tlsh":"e413a0d427c1e40766cd1ba3bf02bae8e03ba8b679c4a54792547a9c74bc517c2b4df0"},{"path":"dist/config.js","sha256":"342bfb6ca81f31855b8ef326c0805e7d9f07e0ddb849d2c03be386568d307850","tlsh":"b0c28cd46781e40766ce5fa3ff06b9ede03ba87679c4a8478264769c68b8507c1b0df0"},{"path":"dist/format.js","sha256":"4fd83af52d69722cd5b0a4d4c16a84d967f21982eacc92384bed50096e660852","tlsh":"0113bed067d0e40766cd0ba3bf06bde8e07aa8b279c8a8479654769c78b8507c1f4df4"},{"path":"dist/mcp.js","sha256":"64ff5e8d2945ec9398628acb5c96d72ec5b84c8fc7e0d98ef09ddfea50054875","tlsh":"c5f269d43680e40366cd4ba3ff02bdede16ea87279c8a50b92547a8c687c517d1b4ef4"},{"path":"dist/surface-parity.js","sha256":"f362dc09a9ab926fcce030f7ff176bb6c8792c387319fe41725a0619713a0b07","tlsh":"3283c0d457c4d107609d0b53bf42aee8e13ba96a78c8b6039650b76c28f8807d5fadf4"}],"package_integrity":[{"filename":"numbors-1.6.1.tgz","hashes":{"sha1":"d256ac1aad915ed15311a3ea935b09c359996de6","sha512_sri":"sha512-qjzZHsPqCPbBURaS/kLOG3k3wBN0QNOvq8+wzoobSfTWyBroe6w39Z7ZSDQxYtjrhREntdFoEqFyKlfFJFKC2A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/numbors/MAL-2026-18322.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-682c-pwqm-7gxv"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/numbors/v/1.6.1"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-682c-pwqm-7gxv","import_time":"2026-10-26T04:32:37.266886338Z","modified_time":"2026-10-26T02:39:50Z","sha256":"287297439c9bdf199a88d43f3722ab361fde262c2ff3ee0f813fff21275211db","source":"ghsa-malware","versions":["1.6.1"]},{"id":"IN-MAL-2026-022014","import_time":"2026-10-29T14:14:17.506516288Z","modified_time":"2026-10-29T13:37:38Z","sha256":"e9965eb6c2b7018707d2ca2ea1840355875eec43f0fc1efb9f03b45cf0566e1a","source":"amazon-inspector","versions":["1.6.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}