{"id":"MAL-2026-985","kind":"package","aliases":["MAL-2026-985"],"related":[],"title":"Malicious code in conduit-utils (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a7f95b03bc8b7d9992089476c92239b5de48ab75b1d3c1d13e9b231dcc79a52)\nThe package conduit-utils was found to contain malicious code.\n\n## Source: ossf-package-analysis (9f633d16f7a0d621de3ff6221f99ffbc77f942c409d0d2adfbe58307211688bf)\nThe OpenSSF Package Analysis project identified 'conduit-utils' @ 2.95.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"conduit-utils","fixed":[],"affected":"= 2.95.0; = 3.99.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-02-22T20:45:43+00:00","first_seen_at":"2026-11-10T18:23:10+00:00","triaged_at":"2026-11-10T18:26:19+00:00","updated_at":"2026-11-10T18:26:19+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,12A '-985':10A,13A '2.95.0':59C '9a7f95b03bc8b7d9992089476c92239b5de48ab75b1d3c1d13e9b231dcc79a52':32C '9f633d16f7a0d621de3ff6221f99ffbc77f942c409d0d2adfbe58307211688bf':49C 'activ':77C 'amazon':30C 'amazon-inspector':29C 'analysi':48C,53C 'associ':74C 'code':2A,43C 'communic':70C 'conduit':5A,15A,36C,57C 'conduit-util':4A,35C,56C 'conduit-utils':14A 'consid':65C 'contain':41C 'detail':21C 'domain':73C 'edit':24C 'found':39C 'identifi':55C 'inspector':31C 'line':27C 'mal':8A,11A 'malici':1A,17B,42C,62C,66C,76C 'npm':7A,60C 'openssf':51C 'ossf':46C 'ossf-package-analysi':45C 'packag':18B,34C,47C,52C,69C 'per':19C 'project':54C 'sourc':20C,28C,44C 'util':6A,37C,58C 'utils':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["conduitutils"],"ptokens":["conduit","utils"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-2026':9A,12A '-985':10A,13A 'code':2A 'conduit':5A,15A 'conduit-util':4A 'conduit-utils':14A 'mal':8A,11A 'malici':1A 'npm':7A 'util':6A 'utils':16A","search_b":"'malici':17B 'packag':18B","search_c":"'2.95.0':59C '9a7f95b03bc8b7d9992089476c92239b5de48ab75b1d3c1d13e9b231dcc79a52':32C '9f633d16f7a0d621de3ff6221f99ffbc77f942c409d0d2adfbe58307211688bf':49C 'activ':77C 'amazon':30C 'amazon-inspector':29C 'analysi':48C,53C 'associ':74C 'code':43C 'communic':70C 'conduit':36C,57C 'conduit-util':35C,56C 'consid':65C 'contain':41C 'detail':21C 'domain':73C 'edit':24C 'found':39C 'identifi':55C 'inspector':31C 'line':27C 'malici':42C,62C,66C,76C 'npm':60C 'openssf':51C 'ossf':46C 'ossf-package-analysi':45C 'packag':34C,47C,52C,69C 'per':19C 'project':54C 'sourc':20C,28C,44C 'util':37C,58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-02-22T20:45:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-985","url":"https://osv.dev/vulnerability/MAL-2026-985","severity":"critical","published_at":"2026-02-22T20:45:43+00:00","modified_at":"2026-11-10T17:30:48+00:00","first_seen_at":"2026-11-10T18:23:10+00:00","fetched_at":"2026-11-10T18:23:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}