{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ]
      },
      "package": {
        "ecosystem": "npm",
        "name": "@nativescript-community/ui-material-bottom-navigation"
      },
      "versions": [
        "7.2.72",
        "7.2.73",
        "7.2.74",
        "7.2.75"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2025-09-17T05:59:34.583354Z",
        "modified_time": "2025-09-17T05:58:45Z",
        "sha256": "c1599f8fe4dad02bc9f083f9d6c3af166818ba3a80e2bb13c37a4052f581b81c",
        "source": "google-open-source-security",
        "versions": [
          "7.2.75",
          "7.2.74",
          "7.2.73",
          "7.2.72"
        ]
      }
    ]
  },
  "details": "The package was compromised and malicious code added.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (c1599f8fe4dad02bc9f083f9d6c3af166818ba3a80e2bb13c37a4052f581b81c)\nThis package was compromised by the Shai-Hulud NPM worm. The malicious payload\nsteals tokens and credentials and publishes them to GitHub before propogating\nitself to NPM packages the user owns.\n",
  "id": "MAL-2025-47389",
  "modified": "2025-09-17T06:23:36Z",
  "published": "2025-09-16T17:05:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"
    },
    {
      "type": "WEB",
      "url": "https://semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/"
    },
    {
      "type": "WEB",
      "url": "https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"
    },
    {
      "type": "WEB",
      "url": "https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised"
    },
    {
      "type": "WEB",
      "url": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Malicious code in @nativescript-community/ui-material-bottom-navigation (npm)"
}