{"id":"MAL-2026-12319","summary":"Malicious code in @kite-js-tools/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9)\npackage.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET to https://d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro/ with the installer's hostname and process PID embedded in the URL path. The postinstall hook performs a DNS resolution against postinstall.\u003chostname\u003e.d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro, leaking the same host identifier via DNS to the same collaborator subdomain. The destination is a Project Discovery Interactsh (OAST) subdomain — out-of-band callback infrastructure typically used to confirm code execution and exfiltrate identifying data from compromised machines. Installer-side host identifiers leave the machine to an attacker-controlled endpoint on every install.\n","modified":"2026-08-05T13:35:05.565824050Z","published":"2026-08-05T13:04:58Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T13:04:58Z","sha256":"5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014874","import_time":"2026-08-05T13:08:52.348427671Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kite-js-tools/core/v/1.0.0"}],"affected":[{"package":{"name":"@kite-js-tools/core","ecosystem":"npm","purl":"pkg:npm/%40kite-js-tools/core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"81f0c93ece70db3136c08ae0060f0605f473891a81160904ebe3274d12ce3aa49bf495","path":"package.json","sha256":"90cbe6cbf418bdaeef7e43fe7328490f1f2046833b13de8495a82c1163ffba08"}],"package_integrity":[{"filename":"core-1.0.0.tgz","hashes":{"sha1":"52287aeeb0c61f70751a71715f96eee42ba1aa41","sha512_sri":"sha512-vkyCA4ipdaiB0XzrKqpNDN4gDfvEcGKqpbfGlp4LMdJ7IdDFcIQWxZMvld1m2HJBuawQAc4kUATYFoK3PKiVOA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kite-js-tools/core/MAL-2026-12319.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}