{"id":"MAL-2026-12491","summary":"Malicious code in uploader-frontend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911)\nThe package's `scripts.install` runs `node index.js`, which loads `./lib/core` and, on `npm install`, collects the installer's OS username (via `os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, encodes them as a subdomain, and issues a `dns.resolve4` lookup against the hardcoded attacker domain `oob.sl4x0.xyz` — a DNS out-of-band beacon that exfiltrates installer identity. The `require` targets (`dns`, `os`, `process`), the API names (`userInfo`, `username`, `hostname`, `cwd`, `resolve4`), and the destination domain are reconstructed at runtime from `String.fromCharCode` numeric arrays to hide the destination and the APIs used. Package name and README advertise `uploader-frontend` / enterprise utilities and validation, but the auto-executed code implements no such functionality — only the beacon. The `author` email `research@sl4x0.xyz` shares the domain of the exfil host, and `homepage` points at an unrelated project (`github.com/slaxorg/nms-dashboard-js`), indicating publisher-controlled attacker infrastructure.\n","modified":"2026-08-05T13:36:23.518509948Z","published":"2026-08-05T13:06:25Z","database_specific":{"malicious-packages-origins":[{"versions":["9.9.11"],"id":"IN-MAL-2026-014884","import_time":"2026-08-05T13:08:52.92941656Z","modified_time":"2026-08-05T13:06:25Z","sha256":"434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/uploader-frontend/v/9.9.11"}],"affected":[{"package":{"name":"uploader-frontend","ecosystem":"npm","purl":"pkg:npm/uploader-frontend"},"versions":["9.9.11"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"7e5dffc0070dfd23371f2f41227b1e3b0f81b85bfaf4fe87e35c5c64e5ddd748","tlsh":"87e068077307c94fa1c80bf77e0050e1ba0d8b59a15dc0d6b518678500af443c1c0232"},{"path":"package.json","sha256":"0247cc50a0a57a241e6eda6714516e5864f23389977049c30052cfb3a69abd2f","tlsh":"01215b35ce244c236ec86aa49c692a42f5a24c174d407c1973c7912c8fef26f51bf65d"}],"package_integrity":[{"filename":"uploader-frontend-9.9.11.tgz","hashes":{"sha1":"5af34c2336d4d04a61dfc054b87749c878df4b02","sha512_sri":"sha512-ERPOwIjslWpFmQQAd6L0n91vaFjFGhD3lGCTkM6srdH3dQ5dusYjqXcrhHuiVmFksOqfBGFXFKu9q8380WKToA=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uploader-frontend/MAL-2026-12491.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}