Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in json-to-table-util (npm)

The npm package json-to-table-util version 1.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with domains associated with malicious activity and executes commands associated with malicious behavior.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All users of json-to-table-util version 1.0.0
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • json-to-table-util · 1.0.0

The OpenSSF Package Analysis project identified json-to-table-util version 1.0.0 on npm as containing malicious code. The analysis determined that the package exhibits two key indicators of malicious intent: communication with a domain associated with malicious activity and execution of commands associated with malicious behavior.\n\nThis finding was published on July 28, 2026, and credited to the OpenSSF malicious-packages repository. The malicious package was assigned identifier MAL-2026-11119.\n\nUsers who have installed json-to-table-util version 1.0.0 should immediately remove or update the package to a safe version if available.

Indicators of compromise

Packages
  • json-to-table-util@1.0.0

Remediation

  • Remove json-to-table-util version 1.0.0 from all environments
  • Audit systems that may have executed code from this package for signs of compromise
  • Check for any suspicious network connections or command execution logs from the time of installation
  • Update to a patched version of json-to-table-util if available, or use an alternative package
  • Review npm audit logs and consider using npm security tools to detect other potentially malicious packages

Sources

  1. GitHub Advisory GHSA-j9fg-prmr-97cw · GitHub Advisory Database

Cite this entry

"Malicious code in json-to-table-util (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-json-to-table-util-npm-15h3bw

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malware in @omniwatch-wick/cli

    Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. activecritical

    Malware in chain-manager

    Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.

    npmCompromised package
  3. containedcritical

    Malicious code in toll_free (npm)

    The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.

    npmCompromised package
  4. containedcritical

    Malicious code in blots (npm)

    The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.

    npmCompromised package