mal-2026-6723
Vulnerability from ossf_malicious_packages
Published
2026-07-01 21:15
Modified
2026-07-01 22:04
Summary
Malicious code in electron-orbit (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f)
On require('electron-orbit'), the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no document is present) that opens a raw node:net socket to electronorbit.blob.core.windows.net:443 and speaks a hand-written TLS 1.3 stack (custom ClientHello, HKDF key schedule, AES-128-GCM in aetherls.ts) rather than using https, bypassing standard TLS interception and static inspection. Every network-related string — the Azure hostname components, node:net, connect, ALPN http/1.1, HTTP request line, marker filename, and process.env enumeration keys — is XOR-obfuscated through a helper __s(key, arr). The postinstall script install.js writes an install marker to os.tmpdir()/electron_orbit_install_marker.txt containing process.env entries whose keys match path (PATH-family variables) plus process.cwd(), and separately stages os.hostname(), os.userInfo().username, process.version, platform and arch into a decoy file under bin/formatters/ prefixed with a fake native-binary magic byte. On require, index.ts reads the tmpdir marker, XORs it with the string electron-orbit, hex-encodes it, and appends the result as a query-string suffix to the Azure blob URL, so the storage account's HTTP request logs capture the installer's PATH-family environment and working directory. Activation is gated: the destination host is only populated when the SHA-256 of process.env.BuildType is a substring of a hardcoded 64-hex constant (0ceaa396…8295); otherwise the source is set to %TEMP% and the request fails to resolve, keeping the payload dormant on non-targeted installers and firing only when a specific env var is set (e.g., in a chosen CI environment). The advertised purpose (Electron-style runtime discovery) has no relationship to icon fetching or SVG rendering; the icon surface is a pretext — getRegisteredIcon returns a hardcoded empty <svg> regardless of the network response.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
Amazon Inspector
inspector-research@amazon.com
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "install.js",
"sha256": "74371bc877a042a9e43f531ec89a9ceb11fb1e002fa19f7c5190799ec713a09c",
"tlsh": "3ef1324286aa4670573213aa8d578d09f7369a170702525e7efd83885fb6c2094e3ffe"
},
{
"path": "dist/index.js",
"sha256": "5442d0af9d1b2fda5b5f6ddecc9450d4b1aeeca0e015e1186ad3440b7ff72124",
"tlsh": "1d32a9907f50f0b5e3ad269594bba94bb3f459d0d80e0408e16998cf3a70cd4c677fa9"
},
{
"path": "package.json",
"sha256": "c4298a843c8b4ba6cc0bda50808a8e083754b57c92e3c8244573d6f96c5d4690",
"tlsh": "84215637e4a4dd535af89b94a8790f89f2310b9f41145c0b74b2012c0bb646b01aebaf"
}
],
"package_integrity": [
{
"filename": "electron-orbit-1.0.36.tgz",
"hashes": {
"sha1": "aca7b7cf1a21403da0981661ff9301a98ecf3f7d",
"sha512_sri": "sha512-WXA8oVnmBi3HZ5YQ+XHZDGBKK+CGruS364F6OhdRptVx6YHRYxFBvJc/9BwOniDn+PibLVMFlslORnO3EdKPZQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "electron-orbit"
},
"versions": [
"1.0.21",
"1.0.11",
"1.0.14",
"1.0.4",
"1.0.22",
"1.0.23",
"1.0.13",
"1.0.20",
"1.0.26",
"1.0.10",
"1.0.15",
"1.0.12",
"1.0.3",
"1.0.33",
"1.0.34",
"1.0.36",
"1.0.28",
"1.0.27",
"1.0.29",
"1.0.30",
"1.0.25",
"1.0.7",
"1.0.16",
"1.0.5",
"1.0.9",
"1.0.8",
"1.0.6",
"1.0.24",
"1.0.32",
"1.0.18",
"1.0.31"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-007924",
"import_time": "2026-07-01T22:03:00.008165656Z",
"modified_time": "2026-07-01T21:17:12Z",
"sha256": "10848278600fe8696063359d8f022d4d0732ac5825506d800707afe08110320e",
"source": "amazon-inspector",
"versions": [
"1.0.21"
]
},
{
"id": "IN-MAL-2026-007932",
"import_time": "2026-07-01T22:03:00.537333616Z",
"modified_time": "2026-07-01T21:18:29Z",
"sha256": "b925cd8754d91ca746f88287af2d6331578be16f842665ba2dd746665d20089a",
"source": "amazon-inspector",
"versions": [
"1.0.11"
]
},
{
"id": "IN-MAL-2026-007931",
"import_time": "2026-07-01T22:03:00.466853262Z",
"modified_time": "2026-07-01T21:18:22Z",
"sha256": "47e8d77c0b581ef00c04e40584b9242f1e948d0330e76f877783a975d863d244",
"source": "amazon-inspector",
"versions": [
"1.0.14"
]
},
{
"id": "IN-MAL-2026-007936",
"import_time": "2026-07-01T22:03:00.819999477Z",
"modified_time": "2026-07-01T21:19:02Z",
"sha256": "92153bc4e68cffd4c1d0e5b11ca3bc772f77b25cfbe012b5f71614de1288b990",
"source": "amazon-inspector",
"versions": [
"1.0.4"
]
},
{
"id": "IN-MAL-2026-007922",
"import_time": "2026-07-01T22:02:59.898992079Z",
"modified_time": "2026-07-01T21:16:54Z",
"sha256": "952200b7df4332004cc5fefbaa4bcb7d8f1ab097c295e79afae66fe19d23aae6",
"source": "amazon-inspector",
"versions": [
"1.0.22"
]
},
{
"id": "IN-MAL-2026-007923",
"import_time": "2026-07-01T22:02:59.969074194Z",
"modified_time": "2026-07-01T21:17:04Z",
"sha256": "e88ccedca508e4a1138bf6749aeb112e97fdea672ffd4d8553d99da05dbc84a5",
"source": "amazon-inspector",
"versions": [
"1.0.23"
]
},
{
"id": "IN-MAL-2026-007929",
"import_time": "2026-07-01T22:03:00.311405766Z",
"modified_time": "2026-07-01T21:18:03Z",
"sha256": "8de289d6073561060a409931399a18484fd826ada63e5fae4f2b30c618172ac4",
"source": "amazon-inspector",
"versions": [
"1.0.13"
]
},
{
"id": "IN-MAL-2026-007926",
"import_time": "2026-07-01T22:03:00.17503458Z",
"modified_time": "2026-07-01T21:17:32Z",
"sha256": "c29ff208e55231dcf792181b153ecbf8d546a0f285f415ccae0358f0d0e757d1",
"source": "amazon-inspector",
"versions": [
"1.0.20"
]
},
{
"id": "IN-MAL-2026-007918",
"import_time": "2026-07-01T22:02:59.695838704Z",
"modified_time": "2026-07-01T21:16:14Z",
"sha256": "816096531ac2b919acfef3d9512968cf694c98e14cb2ee1ce1430877ce39170a",
"source": "amazon-inspector",
"versions": [
"1.0.26"
]
},
{
"id": "IN-MAL-2026-007933",
"import_time": "2026-07-01T22:03:00.584279878Z",
"modified_time": "2026-07-01T21:18:38Z",
"sha256": "19c68f98c57515e576aef9cc6bd4d2801f813b382d3ea55091c423663d8106cf",
"source": "amazon-inspector",
"versions": [
"1.0.10"
]
},
{
"id": "IN-MAL-2026-007928",
"import_time": "2026-07-01T22:03:00.253967834Z",
"modified_time": "2026-07-01T21:17:53Z",
"sha256": "36ceb992564dfb37d1d5d28dc2b31f99361fc1392c85592bfce2b97eef195c90",
"source": "amazon-inspector",
"versions": [
"1.0.15"
]
},
{
"id": "IN-MAL-2026-007930",
"import_time": "2026-07-01T22:03:00.427547597Z",
"modified_time": "2026-07-01T21:18:12Z",
"sha256": "54c50d1b1671037faea6193cf6d7994bfd7c4fba7640d2935546712d7ebed8e7",
"source": "amazon-inspector",
"versions": [
"1.0.12"
]
},
{
"id": "IN-MAL-2026-007939",
"import_time": "2026-07-01T22:03:00.97514881Z",
"modified_time": "2026-07-01T21:19:27Z",
"sha256": "77275717c30e5629daba99b0a9ae1dd5a30b7b3fb013fe66a66a8213ab32ad8e",
"source": "amazon-inspector",
"versions": [
"1.0.3"
]
},
{
"id": "IN-MAL-2026-007914",
"import_time": "2026-07-01T22:02:59.522446423Z",
"modified_time": "2026-07-01T21:15:45Z",
"sha256": "78d034e73e1a01e3c47c1b0ade337cd56fd392e0be1398b13fbdf051d6166220",
"source": "amazon-inspector",
"versions": [
"1.0.33"
]
},
{
"id": "IN-MAL-2026-007911",
"import_time": "2026-07-01T22:02:59.407241934Z",
"modified_time": "2026-07-01T21:15:19Z",
"sha256": "bae81fe7c1395441c366ea9e03e33844d0f8ce1cd5d05c40873cd4fb858bb64d",
"source": "amazon-inspector",
"versions": [
"1.0.34"
]
},
{
"id": "IN-MAL-2026-007912",
"import_time": "2026-07-01T22:02:59.444375253Z",
"modified_time": "2026-07-01T21:15:26Z",
"sha256": "6245487ae50f09a690451f235b8c9855d2f666f2b0a25e93871cf7a1251b5d69",
"source": "amazon-inspector",
"versions": [
"1.0.36"
]
},
{
"id": "IN-MAL-2026-007919",
"import_time": "2026-07-01T22:02:59.770673779Z",
"modified_time": "2026-07-01T21:16:21Z",
"sha256": "7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f",
"source": "amazon-inspector",
"versions": [
"1.0.28"
]
},
{
"id": "IN-MAL-2026-007917",
"import_time": "2026-07-01T22:02:59.656385696Z",
"modified_time": "2026-07-01T21:16:07Z",
"sha256": "74a4c2467a3c20b1532b6935cc3ae3c984c06c696a4a430c886f155a562ce3f4",
"source": "amazon-inspector",
"versions": [
"1.0.27"
]
},
{
"id": "IN-MAL-2026-007916",
"import_time": "2026-07-01T22:02:59.615635898Z",
"modified_time": "2026-07-01T21:15:59Z",
"sha256": "8607b322e5ebd914296b192b0877ba45f5e9750dc69c924f7d939d2b8b378c5f",
"source": "amazon-inspector",
"versions": [
"1.0.29"
]
},
{
"id": "IN-MAL-2026-007915",
"import_time": "2026-07-01T22:02:59.555589088Z",
"modified_time": "2026-07-01T21:15:52Z",
"sha256": "8c298b3f9b2691ab1ebb958398e1736aa636d9ee4e5d54acb0b57a5e1f93167c",
"source": "amazon-inspector",
"versions": [
"1.0.30"
]
},
{
"id": "IN-MAL-2026-007920",
"import_time": "2026-07-01T22:02:59.802868311Z",
"modified_time": "2026-07-01T21:16:33Z",
"sha256": "9c9d089e560d6af7ee6fbfc04edfc6f073ef8fec7f555102011e47f2f33a3df7",
"source": "amazon-inspector",
"versions": [
"1.0.25"
]
},
{
"id": "IN-MAL-2026-007937",
"import_time": "2026-07-01T22:03:00.877084463Z",
"modified_time": "2026-07-01T21:19:09Z",
"sha256": "d9634442d2460040970659611fb37887044b6a6f10a63c17f73161b1b21a3ce0",
"source": "amazon-inspector",
"versions": [
"1.0.7"
]
},
{
"id": "IN-MAL-2026-007927",
"import_time": "2026-07-01T22:03:00.214957014Z",
"modified_time": "2026-07-01T21:17:42Z",
"sha256": "150616fc5c43dab7fcc26b65b7817ccc01229778cc7bcf143025d16b4d3cc3da",
"source": "amazon-inspector",
"versions": [
"1.0.16"
]
},
{
"id": "IN-MAL-2026-007938",
"import_time": "2026-07-01T22:03:00.915016621Z",
"modified_time": "2026-07-01T21:19:17Z",
"sha256": "1d12525ca427cbe9367a0caefb4b1020cc0593fa2b428b691c0e635a48d2757c",
"source": "amazon-inspector",
"versions": [
"1.0.5"
]
},
{
"id": "IN-MAL-2026-007934",
"import_time": "2026-07-01T22:03:00.682327954Z",
"modified_time": "2026-07-01T21:18:48Z",
"sha256": "70733642ade646f823a77e8ae1616337f76e9340fc84a3a5da7c2365a58f6d00",
"source": "amazon-inspector",
"versions": [
"1.0.9"
]
},
{
"id": "IN-MAL-2026-007935",
"import_time": "2026-07-01T22:03:00.733638694Z",
"modified_time": "2026-07-01T21:18:54Z",
"sha256": "c37583c0ed58e2b399630b0a314361d54f7b4927faeadcba99122205c37d78fa",
"source": "amazon-inspector",
"versions": [
"1.0.8"
]
},
{
"id": "IN-MAL-2026-007941",
"import_time": "2026-07-01T22:03:01.087889736Z",
"modified_time": "2026-07-01T21:19:44Z",
"sha256": "1402a4a73f05f68a55951e93a03c1758d6406fb97a056d84802c21244e3d5393",
"source": "amazon-inspector",
"versions": [
"1.0.6"
]
},
{
"id": "IN-MAL-2026-007921",
"import_time": "2026-07-01T22:02:59.843512238Z",
"modified_time": "2026-07-01T21:16:46Z",
"sha256": "b81cc5f0d2ed6deaed9b0956f47d024f9c42b291090c71d5abec8e34d0c2ab62",
"source": "amazon-inspector",
"versions": [
"1.0.24"
]
},
{
"id": "IN-MAL-2026-007913",
"import_time": "2026-07-01T22:02:59.476587914Z",
"modified_time": "2026-07-01T21:15:36Z",
"sha256": "c3b84ec0bc193e98c0c57657693f84fc2ccbe0ef8ed7a66b919d9ec486d5e515",
"source": "amazon-inspector",
"versions": [
"1.0.32"
]
},
{
"id": "IN-MAL-2026-007925",
"import_time": "2026-07-01T22:03:00.042382523Z",
"modified_time": "2026-07-01T21:17:25Z",
"sha256": "b84bfc662b2e38c56da1343ec68aa18255a7a43be7a97ef9227de541e0a9a5a2",
"source": "amazon-inspector",
"versions": [
"1.0.18"
]
},
{
"id": "IN-MAL-2026-007910",
"import_time": "2026-07-01T22:02:59.371792985Z",
"modified_time": "2026-07-01T21:15:10Z",
"sha256": "c7750cd6d1bd46851da24a4090675984c9f66dd4b8d3634e9a58ce6896a2c11c",
"source": "amazon-inspector",
"versions": [
"1.0.31"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f)\nOn `require(\u0027electron-orbit\u0027)`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `document` is present) that opens a raw `node:net` socket to `electronorbit.blob.core.windows.net:443` and speaks a hand-written TLS 1.3 stack (custom ClientHello, HKDF key schedule, AES-128-GCM in aetherls.ts) rather than using `https`, bypassing standard TLS interception and static inspection. Every network-related string \u2014 the Azure hostname components, `node:net`, `connect`, ALPN `http/1.1`, HTTP request line, marker filename, and `process.env` enumeration keys \u2014 is XOR-obfuscated through a helper `__s(key, arr)`. The postinstall script `install.js` writes an install marker to `os.tmpdir()/electron_orbit_install_marker.txt` containing `process.env` entries whose keys match `path` (PATH-family variables) plus `process.cwd()`, and separately stages `os.hostname()`, `os.userInfo().username`, `process.version`, platform and arch into a decoy file under `bin/formatters/` prefixed with a fake native-binary magic byte. On `require`, index.ts reads the tmpdir marker, XORs it with the string `electron-orbit`, hex-encodes it, and appends the result as a query-string suffix to the Azure blob URL, so the storage account\u0027s HTTP request logs capture the installer\u0027s PATH-family environment and working directory. Activation is gated: the destination host is only populated when the SHA-256 of `process.env.BuildType` is a substring of a hardcoded 64-hex constant (`0ceaa396\u20268295`); otherwise the source is set to `%TEMP%` and the request fails to resolve, keeping the payload dormant on non-targeted installers and firing only when a specific env var is set (e.g., in a chosen CI environment). The advertised purpose (Electron-style runtime discovery) has no relationship to icon fetching or SVG rendering; the icon surface is a pretext \u2014 `getRegisteredIcon` returns a hardcoded empty `\u003csvg\u003e` regardless of the network response.\n",
"id": "MAL-2026-6723",
"modified": "2026-07-01T22:04:51Z",
"published": "2026-07-01T21:15:10Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.21"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.11"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.14"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.22"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.23"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.13"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.20"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.26"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.10"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.15"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.12"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.3"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.33"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.34"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.36"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.28"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.27"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.29"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.30"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.25"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.7"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.16"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.9"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.8"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.6"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.24"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.32"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.18"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/electron-orbit/v/1.0.31"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in electron-orbit (npm)"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…