{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "business-kpi-manager",
        "purl": "pkg:npm/business-kpi-manager"
      },
      "versions": [
        "2.3.0",
        "4.0.4",
        "4.0.5",
        "4.0.7",
        "4.0.3",
        "4.0.1",
        "4.0.0",
        "4.0.6"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "RLMA-2024-00444",
        "import_time": "2024-06-28T02:42:06.588242233Z",
        "modified_time": "2024-06-25T12:30:21Z",
        "sha256": "e50c66f5aaba8c1ccfaa2e82e033a82da11c8bccb21c583203e5c2e3c1d563c0",
        "source": "reversing-labs",
        "versions": [
          "2.3.0"
        ]
      },
      {
        "id": "RLUA-2024-06256",
        "import_time": "2024-10-24T00:57:36.462467618Z",
        "modified_time": "2024-10-16T12:36:17Z",
        "sha256": "5d8551cbf195f119da5bf7e861b67f56fa56492ebdb3b2f25435d985e035c49e",
        "source": "reversing-labs"
      },
      {
        "import_time": "2025-01-22T09:34:36.852550218Z",
        "modified_time": "2025-01-21T16:45:49Z",
        "sha256": "d40c2ea693da70760733dd3ec3fd7dd594c8c49c6e937ec9699b9ec831cc960e",
        "source": "ossf-package-analysis",
        "versions": [
          "4.0.4"
        ]
      },
      {
        "import_time": "2025-01-22T21:05:25.730960635Z",
        "modified_time": "2025-01-22T14:35:59Z",
        "sha256": "d54e40d9b69a1bb13fcba5c852d84ea8c8ad46d3390ac2976093e9d64b681c0c",
        "source": "ossf-package-analysis",
        "versions": [
          "4.0.5"
        ]
      },
      {
        "id": "RLUA-2025-00684",
        "import_time": "2025-03-03T15:07:23.807344218Z",
        "modified_time": "2025-03-03T13:20:43Z",
        "sha256": "b18564286d2f85a6383f16bb8fb855da5b7674eb0053cd8ff39b2e26dd2488ff",
        "source": "reversing-labs",
        "versions": [
          "4.0.7",
          "4.0.3",
          "4.0.5",
          "4.0.1",
          "4.0.4",
          "4.0.0"
        ]
      },
      {
        "id": "RLUA-2025-02709",
        "import_time": "2025-05-22T14:07:12.22950696Z",
        "modified_time": "2025-05-22T12:41:32Z",
        "sha256": "f7546d2008465fc03968e26c8b97c4ccb3df38b2525181d379d37a30c8041bcc",
        "source": "reversing-labs",
        "versions": [
          "4.0.6"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (d40c2ea693da70760733dd3ec3fd7dd594c8c49c6e937ec9699b9ec831cc960e)\nThe OpenSSF Package Analysis project identified \u0027business-kpi-manager\u0027 @ 4.0.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2024-1847",
  "modified": "2025-05-22T14:07:46Z",
  "published": "2024-06-25T12:30:21Z",
  "schema_version": "1.5.0",
  "summary": "Malicious code in business-kpi-manager (npm)"
}