0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
check-ulid
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting check-ulid, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5877 | Unknown | Malicious code in check-ulid (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ea848e496c2022409208a3e4a7d9b364c9437699a15554a5a1ee953d4428f230) check-ulid is a typosquat of the legitimate `ulid` package (README is copied verbatim, `homepage` and `bugs` link to github.com/ulid/javascript) whose `postinstall` script (`node dist/node/utils.js`) drops and persists a remote-control agent on the installer's machine. utils.js re-spawns itself detached via `spawn(process.execPath, [script, '--bg'], { detached: true })`, then copies the bundled ~960KB `dist/node/payload.js` into `%LOCALAPPD |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ea848e496c2022409208a3e4a7d9b364c9437699a15554a5a1ee953d4428f230) check-ulid is a typosquat of the legitimate `ulid` package (README is copied verbatim, `homepage` and `bugs` link to github.com/ulid/javascript) whose `postinstall` script (`node dist/node/utils.js`) drops and persists a remote-control agent on the installer's machine. utils.js re-spawns itself detached via `spawn(process.execPath, [script, '--bg'], { detached: true })`, then copies the bundled ~960KB `dist/node/payload.js` into `%LOCALAPPD