{"id":"MAL-2026-10734","summary":"Malicious code in infrastructure-common (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578)\npackage.json declares a preinstall lifecycle script that runs `node -e` to issue an HTTP GET to a Burp Collaborator subdomain at w635fyvrqkfmh9wc9uw8444cp3vujl7a.oastify.com when `npm install` runs. The callback confirms code execution on the installer's host and leaks the installer's public IP and DNS resolver to a third-party listener. The package name `infrastructure-common` combined with an implausibly high `99.9.9` version is the canonical dependency-confusion shape, in which a public package is registered to shadow an internal name at install-time resolution.\n","modified":"2026-07-16T19:19:45.987419450Z","published":"2026-07-16T18:38:23Z","database_specific":{"malicious-packages-origins":[{"versions":["99.9.9"],"id":"IN-MAL-2026-010726","import_time":"2026-07-16T18:54:01.431048599Z","modified_time":"2026-07-16T18:38:23Z","sha256":"d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/infrastructure-common/v/99.9.9"}],"affected":[{"package":{"name":"infrastructure-common","ecosystem":"npm","purl":"pkg:npm/infrastructure-common"},"versions":["99.9.9"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"infrastructure-common-99.9.9.tgz","hashes":{"sha1":"96d6035a5bb9599320e85f973b4158a98b82f1b3","sha512_sri":"sha512-IW06zaQde7c+NSf/YdDaJQ1oibW+/JpU8wjUqESSco4N+b0kZAIVWBWc2cOE7MKWeYCZPofPCm1cY1WW6fjj8A=="}}],"evidence_files":[{"sha256":"d91bd983e0c82bcc812a6f1f5cf8141d519203d125e0e74a253d8008d8e236f1","tlsh":"0ae0c0f40460e1bb54e88ad51c720805f0d55e470004ac041be7101e02de36794be1dc","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/infrastructure-common/MAL-2026-10734.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}