{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "amplitude-ma-ts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.22"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://safedep.io"
      ],
      "name": "SafeDep",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-04-27T01:40:38.620278322Z",
        "modified_time": "2026-04-24T01:35:44Z",
        "sha256": "2cba685b107eb30c1b216522bcb10e36df5eb8096a549b86ed097b9dbc7f192c",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.22"
        ]
      }
    ]
  },
  "details": "npm stealer. Hardcoded Discord webhook id 1497047226428690432 in postinstall Folder/bin/S.js. Exfils {hostname, whoami, pwd, public_ip (api.ipify.org), /etc/hosts} via Discord embed. v1.0.21 empty placeholder, v1.0.22 shipped payload \u2014 name-squat-then-poison. Typosquats @amplitude/* analytics scope. Maintainer 4senna \u003cbugbounty4senna+1@gmail.com\u003e (Gmail plus-alias throwaway). Score 20, signals: install_hook + nodejs_phone_home + iplookup_website + discord_bot + discord_exfil + exfil_whoami_hostname. Report: data/reports/research-threat-analysis/reports/2026-04-24-amplitude-ma-ts.md\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (2cba685b107eb30c1b216522bcb10e36df5eb8096a549b86ed097b9dbc7f192c)\nThe OpenSSF Package Analysis project identified \u0027amplitude-ma-ts\u0027 @ 1.0.22 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-3028",
  "modified": "2026-04-27T01:42:39Z",
  "published": "2026-04-24T01:35:44Z",
  "schema_version": "1.7.4",
  "summary": "Malicious code in amplitude-ma-ts (npm)"
}