{"id":"MAL-2025-6695","summary":"Malicious code in amdocs-core-package (npm)","details":"The package communicates with a domain associated with malicious activity.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e196068c171b8528ec4f1f0db852ef32a7b530ecce14d79696a21c4f685c2c6)\nThe package declares a preinstall hook that runs index.js on npm install. index.js requires https and os, reads os.hostname(), and issues an https.request POST to a hardcoded *.oastify.com Burp Collaborator subdomain, additionally embedding the hostname into the DNS label of that subdomain for out-of-band capture. Package metadata is placeholder (empty description and author, version 11.11.11, name shaped like an internal 'amdocs' scope), consistent with a dependency-confusion payload targeting an internal namespace. Installing the package causes the installer's host identifier to leave the machine to an attacker-controlled collaborator domain.\n","modified":"2026-07-13T14:31:57.853468226Z","published":"2025-08-01T17:28:53Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010239","modified_time":"2026-07-13T14:00:58Z","versions":["11.11.11"],"source":"amazon-inspector","sha256":"1e196068c171b8528ec4f1f0db852ef32a7b530ecce14d79696a21c4f685c2c6","import_time":"2026-07-13T14:19:33.148844612Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/amdocs-core-package/v/11.11.11"}],"affected":[{"package":{"name":"amdocs-core-package","ecosystem":"npm","purl":"pkg:npm/amdocs-core-package"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"}]}],"versions":["11.11.11"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amdocs-core-package/MAL-2025-6695.json","indicators":{"package_integrity":[{"hashes":{"sha1":"3667f557c431150c743158381911891fe8a50069","sha512_sri":"sha512-n6F1OlUIuEU4s5WHuJZVZmoM0iPjLyzr6RxFnqbXExp9Z6P2KdvE9v3lHnVV5xpEAaxWtl6T6cw6s7q/3WDvRw=="},"filename":"amdocs-core-package-11.11.11.tgz"}],"evidence_files":[{"tlsh":"b6f0ace0802bd3b08fb29bd4e1159a03d426d322b103496278f943c66bd2e799032cac","path":"index.js","sha256":"866e2619bd25d38ef7f75a1a689a46e11b4b8c0f907a978b32063213cb41a3f1"},{"path":"package.json","sha256":"a43ef4b644489c0e58adfd92adb07e4acb86f3c008ea6de60777f861840c68f1","tlsh":"aad02e345e10563324c00a62082aa45272e0df2f11083c0aa7cb283c92de67788ff30e"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}