{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "domains": [
            "br6o3tu4m5amvthw08w8o1x0srykmia7.oastify.com",
            "scan.br6o3tu4m5amvthw08w8o1x0srykmia7.oastify.com"
          ],
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "b2b7ded05baf0190be2e479d39ef73c811f986cfcaafc7e15a604d422bf60849",
              "tlsh": "58011eb453f4e6b495e21ec0e2558806712be1103340b9e038ec9354ab89a7444b5ced"
            },
            {
              "path": "package.json",
              "sha256": "36d696e3dedf023767b82f606c7c12906e43cae99348653b82658634176d52ed",
              "tlsh": "bed05b1058515733b9c9279e08375149d9a6491b51445c2457d710c447162ba9477365"
            }
          ],
          "package_integrity": [
            {
              "filename": "power-apps-2.0.4.tgz",
              "hashes": {
                "sha1": "ecd08b1aa1354541abb162680ac4e106f7d6b121",
                "sha512_sri": "sha512-3D2/c7aaUXZQ6o971D/fdbjGtC4hb9Yq0dj0/TkHb63siW8hxLViCMyd4zm8WH5DDwmBvtWM8kVjbTAEwfsxWQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "power-apps"
      },
      "versions": [
        "2.0.4",
        "2.0.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-05-24T11:32:32.110932326Z",
        "modified_time": "2026-05-24T11:14:53Z",
        "sha256": "0b922ce655232ea983139e44d430965cdcc1d9784d1628419b4cbef0f5f52073",
        "source": "ossf-package-analysis",
        "versions": [
          "2.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-004488",
        "import_time": "2026-05-26T05:52:41.855257068Z",
        "modified_time": "2026-05-24T11:11:27Z",
        "sha256": "a6315832fdddf911056c8aa9232d8610dfcc36dd82aac9f8ffddc7530b0e27f5",
        "source": "amazon-inspector",
        "versions": [
          "2.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-004487",
        "import_time": "2026-05-26T05:52:41.754690534Z",
        "modified_time": "2026-05-24T11:11:26Z",
        "sha256": "f68653eed66e7343973bc919788864990337f7645072d32a9d7465d4bf4ff4e7",
        "source": "amazon-inspector",
        "versions": [
          "2.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-004485",
        "import_time": "2026-05-26T05:52:41.542086661Z",
        "modified_time": "2026-05-24T11:05:23Z",
        "sha256": "fd1bb5a3a5a6ac8477f57c7ebe3374aeeee9258309e1e723a4c4fb3a701f2df0",
        "source": "amazon-inspector",
        "versions": [
          "2.0.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f68653eed66e7343973bc919788864990337f7645072d32a9d7465d4bf4ff4e7)\nOn `npm install`, postinstall.js executes `whoami`, `id`, and reads `os.hostname()`, `os.platform()`, `process.cwd()`, and CI/GitHub environment variables, then sends the collected data as query-string parameters via HTTPS GET to `br6o3tu4m5amvthw08w8o1x0srykmia7.oastify.com` (a Burp Collaborator out-of-band callback domain). The script also performs a DNS lookup of `\u003cwhoami\u003e.\u003ccallback-host\u003e` as a secondary exfiltration channel. The package name impersonates Microsoft Power Apps and the request path includes `/microsft` (sic), indicating supply-chain reconnaissance against developers searching for Microsoft Power Apps tooling. Installing this package on a developer workstation or CI runner leaks host identity and pipeline environment metadata to an attacker-controlled collaborator endpoint.\n\n## Source: ossf-package-analysis (0b922ce655232ea983139e44d430965cdcc1d9784d1628419b4cbef0f5f52073)\nThe OpenSSF Package Analysis project identified \u0027power-apps\u0027 @ 2.0.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-4274",
  "modified": "2026-05-26T05:55:04Z",
  "published": "2026-05-24T11:05:23Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/power-apps/v/2.0.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/power-apps/v/2.0.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in power-apps (npm)"
}