atlassian-wallboard-plugin@10.0.0
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18437 confirms this npm version as malicious.
Advisory
MAL-2026-18437
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in atlassian-wallboard-plugin (npm)
Details
The OpenSSF Package Analysis project identified 'atlassian-wallboard-plugin' @ 10.0.0 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The remote tarball dependency chain is unusual, but the available source establishes no attack behavior. The package has no declared lifecycle or entry point, so treat this as an unresolved dependency risk and warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
Dependency installation or resolution by the consuming project.
Impact
The available evidence does not show what code is delivered or whether it performs harmful actions.
Mechanism
The manifest references node-ac2 from a GitHub tarball; prepared dependency manifests reference that tarball again and a further node-ac3 tarball.
AI rationale
The remote tarball dependency chain is unusual, but the available source establishes no attack behavior. The package has no declared lifecycle or entry point, so treat this as an unresolved dependency risk and warn rather than block.
Evidence
package.json.lpm-dependency-evidence-49b088bc-a45d-465d-bb94-b9f6a3785a50/0/npm-linux/package.json.lpm-dependency-evidence-49b088bc-a45d-465d-bb94-b9f6a3785a50/1/npm-linux/package.json
Network endpoints2
github.com/GamerD11/ping_test/raw/main/node-ac2.tgzgithub.com/GamerD11/ping_test/raw/main/node-ac3.tgz
Independent scan evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- The manifest depends on node-ac2 from a GitHub tarball URL.
- The prepared node-ac2 manifest declares a second dependency from the same GitHub repository.
- The prepared claims-ac1 manifest also depends on the node-ac2 tarball.
Evidence against
- The package manifest declares no lifecycle scripts, bin, main, or exports entry points.
- The available snapshot contains only dependency manifests, with no executable source to establish what the tarballs do.
Behavioral surface
Source & flagged code
4 flaggedpackage.jsonView file
1{
"name": "atlassian-wallboard-plugin",
"version": "10.0.0",
"description": "Account utility library",
"dependencies": {
"claims-ac1": "^1.0.0",
"node-ac2
High
Ai Review Evidence
The manifest depends on node-ac2 from a GitHub tarball URL.
package.jsonView on unpkg · L1•Remote tarball dependency specs: node-ac2@https://github.com/GamerD11/ping_test/raw/main/node-ac2.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkg.lpm-dependency-evidence-49b088bc-a45d-465d-bb94-b9f6a3785a50/0/npm-linux/package.jsonView file
1{
"name": "node-ac2",
"version": "1.0.0",
"main": "index.js",
"dependencies": {
"node-ac3": "https://github.com/GamerD11/ping_test/raw/main/node-ac3.tgz"
},
"keywords": [],
"author":
Findings
3 High1 Medium
HighAi Review Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-49b088bc-a45d-465d-bb94-b9f6a3785a50/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-49b088bc-a45d-465d-bb94-b9f6a3785a50/1/npm-linux/package.json
MediumRemote Tarball Dependencypackage.json
Affected versions and remediation
This report applies to atlassian-wallboard-plugin@10.0.0.
See all versions of atlassian-wallboard-plugin for other recorded verdicts.
- Avoid installing atlassian-wallboard-plugin@10.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.