malicious-packages database. There is no coordinated-disclosure window (the maintainer is the attacker). codelake never stores raw payloads — only the detection rule, file:line, and IOCs.
demo-awesome-date-parser-test — malicious npm package, independently detected and OSV-corroborated
demo-awesome-date-parser-test is a malicious npm package that codelake Research independently detected during automated supply-chain scanning, corroborated by MAL-2026-11099 in OSV. The detection signal and affected versions are detailed below.
codelake's analysis classifies the detection signal as behaviour that builds and runs code dynamically to evade static detection.
Affected version(s): 0.0.5.
codelake's per-ecosystem scanners flagged the specimen and the AI-triage judge classified it malicious (recorded signal: dynamic-eval pattern (src/index.js:66,71,73), confidence 0.85).
This is an independent detection by codelake's own scanners and AI-triage pipeline; it is corroborated by MAL-2026-11099 in OSV (codelake was not necessarily the first public reporter for this record).
All analysis is performed at the indicator level on extracted source only — codelake never executes specimens and stores only the detection rule, indicators and analysis, never raw payloads.
Detected independently by codelake Research · automated per-ecosystem supply-chain scanning + AI-triage, verified at the indicator level on extracted source (no execution). Corroborated by MAL-2026-11099 in OSV. codelake stores only the detection rule, indicators and analysis, never raw payloads.