{"id":"MAL-2025-14109","kind":"package","aliases":["MAL-2025-14109"],"related":[],"title":"Malicious code in adorn (npm)","description":"The package adorn was found to contain malicious code.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a)\nNo install-time or import-time behavior of concern was observed in this package version. No lifecycle scripts performing network fetch or shell execution, no reads of installer secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment-variable scraping, no hardcoded attacker-controlled network destinations, no obfuscated payloads, and no silent-relay of caller-supplied data were identified.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"adorn","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2025-08-14T18:52:04+00:00","first_seen_at":"2026-10-29T15:54:54+00:00","triaged_at":"2026-10-29T15:55:47+00:00","updated_at":"2026-10-29T15:55:47+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-14109':8A,11A '-2025':7A,10A '/.aws':70C '/.npmrc':72C '/.ssh':71C '2d216a470f43a6fe1d8ad3afea30e01265f3b9d2c25fc6689e296ff7c817489a':37C 'adorn':4A,12A,17C 'amazon':35C 'amazon-inspector':34C 'attack':81C 'attacker-control':80C 'behavior':46C 'caller':95C 'caller-suppli':94C 'code':2A,23C 'concern':48C 'contain':21C 'control':82C 'data':97C 'destin':84C 'detail':26C 'edit':29C 'environ':75C 'environment-vari':74C 'execut':63C 'fetch':60C 'found':19C 'hardcod':79C 'identifi':99C 'import':44C 'import-tim':43C 'inspector':36C 'instal':40C,67C 'install-tim':39C 'lifecycl':56C 'line':32C 'mal':6A,9A 'malici':1A,13B,22C 'network':59C,83C 'npm':5A 'obfusc':86C 'observ':50C 'packag':14B,16C,53C 'path':69C 'payload':87C 'per':24C 'perform':58C 'read':65C 'relay':92C 'scrape':77C 'script':57C 'secret':68C 'shell':62C 'silent':91C 'silent-relay':90C 'sourc':25C,33C 'suppli':96C 'time':41C,45C 'variabl':76C 'version':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2025-08-14T18:52:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2025-14109","url":"https://osv.dev/vulnerability/MAL-2025-14109","severity":"critical","published_at":"2025-08-14T18:52:04+00:00","modified_at":"2026-10-29T14:45:05+00:00","first_seen_at":"2026-10-29T15:54:54+00:00","fetched_at":"2026-10-29T15:54:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}