Malicious code in siren-lament (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8) The package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a placeholder or staging publish rather than a functional library. No code paths that would compromise an installer on npm install or require() were identified. ## Source: ossf-package-analysis (092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f) The OpenSSF Package Analysis project identified 'siren-lament' @ 2.14.827 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Source published

29 Oct 2025 22:29:06 UTC

Source modified

29 Oct 2026 14:30:45 UTC

Observed here

29 Oct 2026 15:12:22 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.