{"id":"MAL-2026-11996","summary":"Malicious code in emulative (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca)\nOn npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.\n","modified":"2026-08-05T00:37:51.988465045Z","published":"2026-08-04T23:57:24Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T00:04:38.793800383Z","modified_time":"2026-08-04T23:57:24Z","sha256":"6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-011360"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/emulative/v/1.0.1"}],"affected":[{"package":{"name":"emulative","ecosystem":"npm","purl":"pkg:npm/emulative"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/emulative/MAL-2026-11996.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"5864e4ab40950600f1e39f253361f70207fd774aa2fe32349ed1f48ada3e1a10","tlsh":"6e411399a2da17330dd210c0660c70802359f9767169a89076cf42969f869f8b7226f3","path":"index.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-UQzS0g5PEVInL3K7C8yMuuL6zSxzk6xDHjcYTQlBAdZUhuM1VVM5sl9Yi5N8+D6AYhAVpjOdyqZCaqZUNoP+tA==","sha1":"121db90604b2147ae5a5465ddb557c04da466a9a"},"filename":"emulative-1.0.1.tgz"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}