{"id":"MAL-2026-12426","summary":"Malicious code in relativity-foundation-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d)\npackage.json declares a preinstall script that runs a Node one-liner collecting os.hostname(), process.env.USER/USERNAME, cwd, npm_config_registry, CI, GITHUB_REPOSITORY, JENKINS_URL, and platform, base64-encodes the JSON blob, and issues an HTTPS GET to https://aiwi9di43fzbjwncfrimdvkgu701orcg.oastify.com/?d=\u003cbase64\u003e on every `npm install`. index.js is empty, so the package's only effect is this reconnaissance beacon. The oastify.com destination is a Burp Collaborator subdomain used as an attacker-controlled out-of-band exfiltration sink.\n","modified":"2026-08-05T13:35:50.251374111Z","published":"2026-08-05T12:59:36Z","database_specific":{"malicious-packages-origins":[{"sha256":"0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d","source":"amazon-inspector","versions":["6.8.2"],"id":"IN-MAL-2026-014838","import_time":"2026-08-05T13:08:50.275070367Z","modified_time":"2026-08-05T12:59:36Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/relativity-foundation-core/v/6.8.2"}],"affected":[{"package":{"name":"relativity-foundation-core","ecosystem":"npm","purl":"pkg:npm/relativity-foundation-core"},"versions":["6.8.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/relativity-foundation-core/MAL-2026-12426.json","indicators":{"evidence_files":[{"path":"package.json","sha256":"988248624029a2a1d021e1a0ad294d799ba1e74a258f93b4bd313f95de534641","tlsh":"f6f0fe2d876cc83b05d10ba025795c879cb2bdaa330898619f53b00e6fe83a2017302f"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}