VYPR
← All malware advisories

npm · Malicious package advisory

Malware

baidu-oscp

MAL-2025-192424

Malicious code in baidu-oscp (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1707ecb3311268a4753a44190db82280e80d16015e5474475863a3e1487aa5c0)
The package baidu-oscp was found to contain malicious code.

## Source: ossf-package-analysis (2758b8fdfed8e0df61c234bf9c6956c5f9970adf98784ba56d0b222b1f8da1a8)
The OpenSSF Package Analysis project identified 'baidu-oscp' @ 19.9.31 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

Compromised versions (2)

  • 19.9.31
  • 19.9.30

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.