{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ]
      },
      "package": {
        "ecosystem": "npm",
        "name": "@nativescript-community/ui-label"
      },
      "versions": [
        "1.3.35",
        "1.3.36",
        "1.3.37"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2025-09-17T05:59:34.663111Z",
        "modified_time": "2025-09-17T05:58:45Z",
        "sha256": "a815032f1d690295898b5c01bd4d17cb73044eebda75187b2877e8299ded777a",
        "source": "google-open-source-security",
        "versions": [
          "1.3.36",
          "1.3.37",
          "1.3.35"
        ]
      }
    ]
  },
  "details": "The package was compromised and malicious code added.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (a815032f1d690295898b5c01bd4d17cb73044eebda75187b2877e8299ded777a)\nThis package was compromised by the Shai-Hulud NPM worm. The malicious payload\nsteals tokens and credentials and publishes them to GitHub before propogating\nitself to NPM packages the user owns.\n",
  "id": "MAL-2025-47388",
  "modified": "2025-09-17T06:23:36Z",
  "published": "2025-09-16T17:05:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"
    },
    {
      "type": "WEB",
      "url": "https://semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/"
    },
    {
      "type": "WEB",
      "url": "https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"
    },
    {
      "type": "WEB",
      "url": "https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised"
    },
    {
      "type": "WEB",
      "url": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Malicious code in @nativescript-community/ui-label (npm)"
}