MAL-2025-6214

Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific mobile application context. The `ecmoaxmpp.umd.js` file revealed a highly suspicious pattern. The code includes a function that checks if `window.mappType` is not equal to `'web'`. When this condition is met, it proceeds to call `window.$wv.databaseHandle`, a function that acts as a bridge to a native mobile application. The methods invoked through this bridge include 'execute', 'rawQuery', 'rawInsert', 'rawUpdate', and 'rawDelete', all of which indicate direct, raw access to a mobile device’s database.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (278b09ddb42295dff2bd8c843131f7f3c9d4d793bb42dd797adbc9c6c825a656) The package was found to contain malicious code or consuming dependency that contains malicious code