{"id":"MAL-2026-12400","summary":"Malicious code in matlab-azure-devops-extension (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b)\nThe package's preinstall script (`node index.js`) auto-executes on `npm install` and collects host identifiers (os.hostname(), os.userInfo().username, home directory, DNS servers) along with the contents of /etc/passwd and /etc/hosts, then POSTs them via HTTPS to a hardcoded Burp Collaborator subdomain at 2ru8qr34u3so6bnti176tzt30u6muci1.oastify.com. The package name mimics an Azure DevOps MATLAB extension but ships no legitimate functionality (empty author, empty description); the package exists only to run the exfil beacon. Consistent with a dependency-confusion / recon probe.\n","modified":"2026-08-05T13:35:37.136979127Z","published":"2026-08-05T13:02:02Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T13:08:51.347114863Z","modified_time":"2026-08-05T13:02:02Z","sha256":"ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-014856"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/matlab-azure-devops-extension/v/1.0.1"}],"affected":[{"package":{"name":"matlab-azure-devops-extension","ecosystem":"npm","purl":"pkg:npm/matlab-azure-devops-extension"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"9e412399a2d917330dd210c06a0c70813359fa777259a89076cf43d69f8a9f8b7326f3","path":"index.js","sha256":"ddea2c2400c432c397364778b7f864fb32193762266f426e078e87a0df6f6c97"},{"sha256":"1f9b415baf29325293deccf5bf2a4a99e60ef7e6618ba57674534b6fd20a9d35","tlsh":"62d02e340d21613329c402628c2b9453b3b28e2f04143c0863cb182c91cea7b98fb30e","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/matlab-azure-devops-extension/MAL-2026-12400.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}