{"id":"MAL-2026-11045","summary":"Malicious code in subapp-pkg-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae)\npackage.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers (os.hostname(), os.userInfo(), os.platform(), OS release) and enriches them with public IP (via ipify) and geo/ISP (via ipapi.co), then POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://dq7q2vt6l79ouvgyzavan3w2rtxkp8gw5.oastify.com/callback. The package self-describes as a dependency-confusion takeover PoC; the beacon fires automatically on install without user interaction.\n\n## Source: ossf-package-analysis (9ec05191ebd2f02dcf912c49fc5d345c3b9201fb691a11a0142fec91cc6d42d4)\nThe OpenSSF Package Analysis project identified 'subapp-pkg-util' @ 99.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-04T22:05:17.133166974Z","published":"2026-07-24T06:42:00Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-24T06:42:00Z","sha256":"9ec05191ebd2f02dcf912c49fc5d345c3b9201fb691a11a0142fec91cc6d42d4","source":"ossf-package-analysis","versions":["99.0.1"],"import_time":"2026-07-24T08:21:08.880839307Z"},{"sha256":"ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae","source":"amazon-inspector","versions":["99.0.1"],"id":"IN-MAL-2026-011088","import_time":"2026-08-04T21:33:16.396544544Z","modified_time":"2026-08-04T21:30:49Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/subapp-pkg-util/v/99.0.1"}],"affected":[{"package":{"name":"subapp-pkg-util","ecosystem":"npm","purl":"pkg:npm/subapp-pkg-util"},"versions":["99.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/subapp-pkg-util/MAL-2026-11045.json","indicators":{"evidence_files":[{"path":"index.js","sha256":"2a0584f72c042fb2449769de340230254e111f46cd502e0795085ec42e2c898c","tlsh":"10710fbb15f5523476f3e29dca0b82012112f1473e45ae69798c33805fcd22a63b27f9"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-3sSDnQobMfGkFDMxLtM5NFzVPDO/8QtWKHX8gHgdOKvKISnvhvbtpq8rK8nq1xZBbGhzNwQDsDZJFSL81LOlkQ==","sha1":"f68f86bc19c140ffe18f27a8d09fe2a914f4d682"},"filename":"subapp-pkg-util-99.0.1.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}