Most recent entries from ossf_malicious_packages

mal-2026-11147

2026-07-28T13:43:24+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c) On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.169.254, plus Tencent, Aliyun, GCP, and Azure endpoints) and extracts the AWS IAM role's temporary security credentials. The captured IAM credentials, hostname, and username are appended as query parameters to an HTTP request to the hardcoded out-of-band host pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (a Burp Collaborator-style domain). The package.json describes the module as a lightweight string formatting helper; the shipped code contains only the credential-harvesting postinstall, with no string-utility functionality present.

mal-2026-11140

2026-07-28T13:42:51+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba) On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODE_ENV!== 'production', checks for a WSL host mount at /mnt/c, locates the Windows user profile, fetches an opaque binary from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat, and writes it to the Windows Startup folder as %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe so that the binary executes on the next Windows login. The URL host, bucket, filename, and dropped executable name are assembled from single-letter variables and template literals rather than appearing as string literals, and the dropped file uses a vite-adjacent name to blend in with legitimate tooling. The fetched payload is not pinned, not verified, and unrelated to any documented package purpose.

mal-2026-11148

2026-07-28T13:42:45+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34) streak-core-lib@1.0.0 presents itself as a 'day-math primitives' library, but index.mjs (the package main, executed on any require/import) contains an end-of-file async IIFE that decodes a hex-encoded Windows PE binary embedded in the source and writes it to the current user's Startup folder as vite-native-helper.exe (%AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe). The destination path components and filename are stored as hex-literal arrays joined and Buffer.from(h,'hex')-decoded at runtime to hide the strings from static inspection, and the embedded payload begins with the MZ header 4D5A90 characteristic of a Windows PE executable. Files placed in the Startup folder execute automatically at every user logon, giving the dropped binary persistent code execution on the installer's Windows host. Inline comments in the file falsely assert that the module 'touches no network and no filesystem' and needs 'no npm lifecycle script', which is contradicted by the fs.writeFile call in the same file. The behavior does not match the package's advertised purpose and fires on import without any user interaction beyond installing the package.

mal-2026-11156

2026-07-28T13:42:28+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7) Package implements a Telegram-bot-driven remote administration tool that gives whoever holds the configured bot token full control of the installer's host. A polling loop calls the Telegram getUpdates API and dispatches received messages as shell commands through subprocess.run (SystemAnalyzer.execute_analysis), exposing a documented `run` command to execute arbitrary system commands. Additional handlers (`findbot`/`getallbots`) walk the filesystem (`/`, `/home`, `/root`, `/etc`, `/var/www`, `/opt`, `/usr/local`, `/tmp`, Windows drive roots and user profile directories), read.py/.json/.conf/.cfg/.env/.ini files, and regex-extract third-party Telegram bot tokens (`BOT_TOKEN`, `API_TOKEN`, `TELEGRAM_TOKEN`, `[0-9]+:[A-Za-z0-9_-]+`), returning them to the remote operator. File and credential exfiltration handlers (`getfile`, `getdir`, `findget`, `getsystem`, `getconfig`, `getpasswords`, `getsshkeys`, `rdpall`) read arbitrary installer paths — including SSH keys and stored credentials — and upload them to the operator's Telegram chat via requests.post to api.telegram.org sendDocument. The package advertises itself as a 'Complete VPS Control System' with 168+ admin commands including user creation and firewall modification.

mal-2026-11134

2026-07-28T13:42:20+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9) The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity (hostname, whoami, id, sudo -l, uname), CI/GitHub Actions environment variables, network interface information, running processes, and environment variables filtered by KEY/TOKEN/SECRET/CREDENTIAL/NPM/AZURE/GCP/CLOUD, then queries cloud instance-metadata endpoints (AWS/Aliyun/GCP/Tencent at 169.254.169.254) to fetch IAM security credentials. The collected data is base64-encoded and curled to the hardcoded attacker-controlled OAST domain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The script also performs DNS and HTTP probes against the internal hostname tst.woa.com and issues an SSRF forwarder request, reporting resolvability back to the same OAST domain. The advertised purpose of the package is color conversion; the actual behavior is credential and cloud-IAM harvesting plus internal-perimeter reconnaissance from every install host.

mal-2026-11138

2026-07-28T14:22:02+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (023b104d04c30fccd05f5db5842a2d8735c572eb13cfbb5ca7ba763eeb525429) The package advertises itself as a JSON/XML schema validator, but both public entry points (validateJson, validateXml in lib/core.js) invoke a trigger() routine that performs remote code execution against the installer's host. The C2 URL is stored as XOR-encoded hex (key 0x55) and decodes to a manifest hosted at https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json. The manifest supplies per-platform payload URLs (wurl/lrurl/laurl/mrurl/maurl) selected by process.platform and process.arch. lib/core.js then spawns node -e (Windows) or sh -c (Linux/macOS) at lines 97 and 114 to execute AES-256-CBC-decrypted staging scripts (aesDecrypt with a statically-derived key) that run the fetched payload. Execution is gated by sandbox-evasion checks in isEnvironment() (os.uptime() >= 300s, os.cpus().length >= 2, os.totalmem() >= 2GB) and a one-shot lock file at ~/.cache/..lock (or %APPDATA%\.cache\..lock) so the dropper runs once per victim. The combined obfuscation of the C2 URL and staging scripts, the sandbox-evasion gating, the per-host persistence marker, and the mismatch between advertised purpose (schema validation) and shipped behavior (attacker-controlled code execution) together confirm hostile intent.

mal-2026-11132

2026-07-28T13:41:20+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336) plugin.js (the package main) contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier (http/https/child_process, URL, RPC method names, C2 host, attacker address, request paths) is written as \uXXXX unicode escapes to evade static inspection. The payload queries Ethereum RPC endpoint eth.drpc.org for the latest transaction sent by hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, derives a C2 IP from the first 4 bytes of that transaction's `to` field (blockchain dead-drop C2 resolution), then fetches two XOR-encrypted payloads over plain HTTP from paths /0x/cls and /0x/ls on the derived host. The first payload is passed to eval(); the second is executed by spawning `node -e` with the decoded content as the argument. This yields full remote code execution on any machine that installs and imports the package, with the C2 endpoint dynamically rotatable by the attacker through new Ethereum transactions.

mal-2026-11149

2026-07-28T13:41:10+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a) index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into %LOCALAPPDATA%/Microsoft/Windows/sysache, and writes vite-native-helper.vbs to the current user's Windows Startup folder. The VBS launcher uses WScript.Shell to run the unpacked RenameMe.exe on every user logon, giving the fetched binary persistent execution under the installer's account. All sensitive strings (the URL, process/fetch/child_process/fs identifiers, AppData/Startup paths, and the VBS body) are stored as hex literals in a `_c` table and decoded at runtime via `Buffer.from(h,'hex').toString()`, hiding the behavior from static inspection. Execution is gated to skip CI, NODE_ENV=production, and browser contexts, so it fires specifically on developer Windows machines. The filenames (vite-native-helper.vbs, sysache) and comments framing the block as a benign startup self-check are cover-story naming inconsistent with the package's advertised math-helper purpose.

mal-2026-11122

2026-07-28T14:22:00+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3) dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXAPAY_MERCHANT_API_KEY, OXAPAY_PAYOUT_API_KEY, OXAPAY_WEBHOOK_SECRET) from the environment together with host metadata (server IP from os.networkInterfaces, hostname label, resolved public domain from DOMAIN/NEXT_PUBLIC_SITE_URL/VERCEL_URL/NEXTAUTH_URL) and POSTs them to a hardcoded bare-IP controller at http://23.160.168.168:4141/register over plain HTTP. The same module opens a WebSocket to ws://23.160.168.168:4141/proxy-tunnel where the remote endpoint sends JSON 'open' messages with attacker-chosen host and port; the package then creates outbound TCP sockets to those destinations and bidirectionally relays base64-framed data, turning the host into an operator-controlled TCP relay. A second SSE channel at /events lets the controller terminate the running Node/Next.js process on a 'stop' event. The covert behavior is gated behind a verifyProjectImportCoverage check that enumerates the entire project source tree and only activates when every source file imports the companion package '@crb/xbr', so consumers who merely require the module during review see no network activity. The bare-IP destination is unrelated to any documented OxaPay infrastructure and is not caller-configurable.

mal-2026-11139

2026-07-28T14:22:02+00:00

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (52bb92157f869a5e1da58a19c88743989d44703201f8d1df250c2543b70b6be3) The package's main entry (index.mjs) contains a chunked base64 blob whose decoded bytes are a Windows PE64 executable (MZ/PE header confirmed, including the 'This program cannot be run in DOS mode' stub). At import time, when running under Linux with a WSL environment detected via existence of /mnt/c, the module writes this embedded binary to /mnt/c/Users//AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. Placement into the Windows Startup folder causes the binary to auto-execute on the next Windows login of the developer whose WSL environment imported the package, giving the publisher code execution on the Windows host. The package.json advertises the module as a 'dependency-free streak counting utility' and the README describes it as an empty placeholder; the PE payload and the WSL persistence path are entirely undocumented. The filename 'vite-native-helper.exe' is a cover-story name unrelated to the package's stated purpose.