{"id":"MAL-2026-12062","summary":"Malicious code in boardwalk-js-tests (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924)\npackage.json declares `preinstall: node index.js`. On `npm install`, index.js collects the installer's hostname, username, homedir, DNS server list, and current working directory, reads /etc/passwd and /etc/hosts, and POSTs the JSON payload over HTTPS to h8q14cqgn5ra8v0bjg70nqxsbjhc52tr.oastify.com — a Burp Collaborator (OAST) subdomain used as an attacker-controlled exfiltration callback. The package provides no advertised functionality; its sole install-time behavior is host reconnaissance and data exfiltration.\n","modified":"2026-08-05T03:20:47.570301460Z","published":"2026-08-05T01:46:56Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T01:46:56Z","sha256":"aceb6d52ccfbb88b344c7edfe504516e6496f7886f95a8fec3b69c5127bd2924","source":"amazon-inspector","versions":["1.1.1"],"id":"IN-MAL-2026-011526","import_time":"2026-08-05T03:11:17.586031731Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boardwalk-js-tests/v/1.1.1"}],"affected":[{"package":{"name":"boardwalk-js-tests","ecosystem":"npm","purl":"pkg:npm/boardwalk-js-tests"},"versions":["1.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"63de072b93910ff613b14b408d8a8d15d78abbe41f030d183c54234b371db5c2","tlsh":"0641139562c917330dd210c06a0c70842359fa777159e99076cf4296af869f8b7316f3"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boardwalk-js-tests/MAL-2026-12062.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}