{"id":"MAL-2026-12360","summary":"Malicious code in csv-parser-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca)\nThe package is advertised as a CSV parser but ships a postinstall.js that runs on `npm install` and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working directory, `uname -a`, container indicators, process tree, and network information; probes AWS and Tencent instance metadata services at 169.254.169.254 and metadata.tencentyun.com; and dumps the full process environment while filtering out only npm noise (retaining any token/secret-shaped variables such as GITHUB_TOKEN, cloud provider keys, and CI credentials). The collected data is base64-encoded and exfiltrated via HTTP GET query string to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package's stated CSV-parsing purpose is a cover story — index.js is unrelated code and no CSV functionality is present.\n","modified":"2026-08-05T13:35:17.151186698Z","published":"2026-08-05T12:32:36Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T12:32:36Z","sha256":"90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014698","import_time":"2026-08-05T13:08:38.665035451Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/csv-parser-helper/v/1.0.0"}],"affected":[{"package":{"name":"csv-parser-helper","ecosystem":"npm","purl":"pkg:npm/csv-parser-helper"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9","tlsh":"8931fbf8b56ded72304dc5f8b75d14053846eaeb58e4ff74281b8875008e48420a9136"}],"package_integrity":[{"filename":"csv-parser-helper-1.0.0.tgz","hashes":{"sha1":"8c59ca801f11e1ffa9fc29aaf7ade649b9cba428","sha512_sri":"sha512-crpnaO+txiJ9xoMLQVjCn/BZlIKaraujwrD3WgPHZwk0jInKKlOGtgKJ74Hq2xXhPLPCUi20NAgcz8w36yoT4Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csv-parser-helper/MAL-2026-12360.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}