{"id":"MAL-2024-2031","summary":"Malicious code in crosswalker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3)\npackage.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects hostname, platform, arch, homedir, username, uid/gid, shell, OS info, cwd, and the output of `whoami` and `id`, then POSTs the JSON payload to a hardcoded URL at `https://kbz9yyzq2mtljdwwf6r0tpzlfcl39txi.oastify.com/detox56`. The destination is a Burp Collaborator subdomain — out-of-band infrastructure used to confirm exfiltration / RCE during dependency-confusion reconnaissance. Installer host and user identifiers leave the machine without consent on every install.\n","aliases":["GHSA-9wxp-r2hc-p64q"],"modified":"2026-09-01T11:31:32.013888339Z","published":"2024-06-25T12:34:37Z","database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","versions":["1.0.1","1.0.0"],"id":"RLMA-2024-00647","import_time":"2024-06-28T02:42:30.582944927Z","modified_time":"2024-06-25T12:34:37Z","sha256":"148095f56bec9386ec4bc32f297a96280fb3915ba079baf9c7d8a614cfb36233"},{"id":"RLUA-2024-06366","import_time":"2024-10-24T00:57:40.422716816Z","modified_time":"2024-10-16T12:41:51Z","sha256":"3836b56aa95dfca87e242dbd470349f3f9cf85007f4c9af2e333e7da622c99dc","source":"reversing-labs"},{"modified_time":"2026-06-23T19:34:10Z","sha256":"b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3","source":"amazon-inspector","versions":["18.2.1"],"id":"IN-MAL-2026-007340","import_time":"2026-06-23T19:40:41.593385812Z"},{"versions":["18.2.1"],"id":"RLUA-2026-05525","import_time":"2026-07-20T13:15:01.435782703Z","modified_time":"2026-07-20T10:38:40Z","sha256":"97c0dfc8d1b2f9b65c1f0ae7d444e1c48a3fdfc21716f6618b4a887f1ebb0312","source":"reversing-labs"},{"sha256":"4333d3f08055f3dccea1aa2ad370c262afc13d583e1bf226bc7276077568ffca","source":"reversing-labs","id":"RLUA-2026-06170","import_time":"2026-09-01T11:18:01.45202027Z","modified_time":"2026-08-24T16:45:58Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/crosswalker/v/18.2.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wxp-r2hc-p64q"}],"affected":[{"package":{"name":"crosswalker","ecosystem":"npm","purl":"pkg:npm/crosswalker"},"versions":["1.0.1","1.0.0","18.2.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"9b80a5d44f4c34ba84fb8da5d6223810240ff1050ac2dacade7e4683216336b0","tlsh":"145162c515f65a241ba7b8494a4f9002a327e0033509ee55bfcc8340af8977c9bf0bf6"},{"path":"i","sha256":"5a80c722939ba6f3373043432a13cefcf6b36a52124ed1e6d261dbecd428953a","tlsh":"d72288760912a800a723bdd54ee8ec5e25e8e47d621f683cf456efb62b8c14d5f1e123"}],"package_integrity":[{"hashes":{"sha1":"c69b513408ce6c3738db322b76ebf9c61f41b9da","sha512_sri":"sha512-StHn4KDn6zhFNxDpUn8UrN+6SEsYSxwx+U6iTkeKaFpOzGQmQCTdAn8cz3gYBfl4tD8MgkxcaZZlTHc4aB9qQg=="},"filename":"crosswalker-18.2.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crosswalker/MAL-2024-2031.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}