🛡️ MAL-2026-4659 — rdflib

Malicious code in rdflib (npm)

Source: amazon-inspector

package.json for this release declares two runtime dependencies — "package-lock.json": "^1.0.0" and "package.json": "^2.0.1" — inside the dependencies block. These are bare names that npm resolves from the public registry, not local files. Neither name is required or referenced anywhere in the rdflib source, so they serve no functional purpose for the library. Their only effect is that running npm install [email protected] will fetch and install those two third-party packages and execute any of their lifecycle scripts on the installer's machine. The names are confusingly chosen to mimic standard npm artifact filenames, which obscures the dependency injection during casual review of package.json. This pattern is consistent with a hijacked/tampered release pulling attacker-controlled transitive code into the installer's dependency tree under the cover of a trusted package name (rdflib).