{"id":"MAL-2026-18716","kind":"package","aliases":["MAL-2026-18716"],"related":[],"title":"Malicious code in @nuri.yavuz.tr.2/my-unique-pinger (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (d9a584d7d9890fd25a656e38f323071b7ac3b419a2050fe50452c598f78a4876)\nThe OpenSSF Package Analysis project identified '@nuri.yavuz.tr.2/my-unique-pinger' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nuri.yavuz.tr.2/my-unique-pinger","fixed":[],"affected":"= 1.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-05T12:36:00+00:00","first_seen_at":"2026-11-06T00:18:41+00:00","triaged_at":"2026-11-06T00:18:44+00:00","updated_at":"2026-11-06T00:19:40+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18716':9A,12A '-2026':8A,11A '1.0.2':40C '2/my-unique-pinger':5A,14A,39C 'analysi':30C,35C 'associ':56C 'behavior':59C 'code':2A 'command':55C 'consid':46C 'd9a584d7d9890fd25a656e38f323071b7ac3b419a2050fe50452c598f78a4876':31C 'detail':19C 'edit':22C 'execut':51C 'identifi':37C 'line':25C 'mal':7A,10A 'malici':1A,15B,43C,47C,58C 'npm':6A,41C 'nuri.yavuz.tr':4A,13A,38C 'one':52C 'openssf':33C 'ossf':28C 'ossf-package-analysi':27C 'packag':16B,29C,34C,50C 'per':17C 'project':36C 'sourc':18C,26C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["myuniquepinger"],"ptokens":["my","nuri","pinger","tr","unique","yavuz"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-11-05T12:36:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18716","url":"https://osv.dev/vulnerability/MAL-2026-18716","severity":"critical","published_at":"2026-11-05T12:36:00+00:00","modified_at":"2026-11-05T23:45:04+00:00","first_seen_at":"2026-11-06T00:18:41+00:00","fetched_at":"2026-11-06T00:18:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}