{"id":"MAL-2025-49247","kind":"package","aliases":["MAL-2025-49247"],"related":[],"title":"Malicious code in siren-lament (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8)\nThe package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a placeholder or staging publish rather than a functional library. No code paths that would compromise an installer on npm install or require() were identified.\n\n## Source: ossf-package-analysis (092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f)\nThe OpenSSF Package Analysis project identified 'siren-lament' @ 2.14.827 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"siren-lament","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2025-10-29T22:29:06+00:00","first_seen_at":"2026-10-29T14:54:46+00:00","triaged_at":"2026-10-29T14:55:09+00:00","updated_at":"2026-10-29T14:55:09+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-2025':9A,12A '-49247':10A,13A '0.0.0':54C '092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f':93C '2.14.827':103C '66198e889':32C 'amazon':30C 'amazon-inspector':29C 'analysi':92C,97C 'associ':119C 'b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8':33C 'behavior':122C 'code':2A,74C 'command':118C 'compromis':78C 'consid':109C 'consist':61C 'contain':36C 'coordin':53C 'count':59C 'credenti':46C 'declar':40C 'detail':21C 'edit':24C 'execut':114C 'exfiltr':50C 'fetch':45C 'file':38C,58C 'function':71C 'identifi':87C,99C 'inspector':31C 'instal':80C,83C 'lament':6A,16A,102C 'librari':72C 'lifecycl':42C 'line':27C 'mal':8A,11A 'malici':1A,17B,106C,110C,121C 'minim':57C 'network':49C 'npm':7A,82C,104C 'one':115C 'openssf':95C 'ossf':90C 'ossf-package-analysi':89C 'packag':18B,35C,91C,96C,113C 'path':51C,75C 'per':19C 'placehold':64C 'project':98C 'publish':67C 'rather':68C 'read':47C 'remot':44C 'requir':85C 'script':43C 'siren':5A,15A,101C 'siren-la':4A,100C 'siren-lament':14A 'sourc':20C,28C,88C 'stage':55C,66C 'two':37C 'version':52C 'would':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2025-10-29T22:29:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2025-49247","url":"https://osv.dev/vulnerability/MAL-2025-49247","severity":"critical","published_at":"2025-10-29T22:29:06+00:00","modified_at":"2026-10-29T14:30:45+00:00","first_seen_at":"2026-10-29T14:54:46+00:00","fetched_at":"2026-10-29T14:54:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}