{"id":"MAL-2026-18460","kind":"package","aliases":["MAL-2026-18460"],"related":[],"title":"Malicious code in dependencykfee-2 (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (bb75f6ebc23c1e1ea6fc3ae422db80b65e8f9b8d7c21faa2de9c58ba049e9d89)\nThe OpenSSF Package Analysis project identified 'dependencykfee-2' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dependencykfee-2","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T18:45:27+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18460':9A,12A '-2':5A,14A,39C '-2026':8A,11A '1.0.0':40C 'analysi':30C,35C 'associ':56C 'bb75f6ebc23c1e1ea6fc3ae422db80b65e8f9b8d7c21faa2de9c58ba049e9d89':31C 'behavior':59C 'code':2A 'command':55C 'consid':46C 'dependencykfe':4A,38C 'dependencykfee':13A 'detail':19C 'edit':22C 'execut':51C 'identifi':37C 'line':25C 'mal':7A,10A 'malici':1A,15B,43C,47C,58C 'npm':6A,41C 'one':52C 'openssf':33C 'ossf':28C 'ossf-package-analysi':27C 'packag':16B,29C,34C,50C 'per':17C 'project':36C 'sourc':18C,26C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["dependencykfee2"],"ptokens":["dependencykfee"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-10-29T18:45:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18460","url":"https://osv.dev/vulnerability/MAL-2026-18460","severity":"critical","published_at":"2026-10-29T18:45:27+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}