{"id":"MAL-2026-12492","summary":"Malicious code in uploader-frontend-legacy (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681)\nThe package's `scripts.install` runs `node index.js`, which loads `lib/core.js` and issues a `dns.resolve4` query against a subdomain of `oob.sl4x0.xyz` constructed from `os.userInfo().username`, `os.hostname()`, and `process.cwd()`, along with a package tag and timestamp. Module names (`os`, `dns`, `process`), API names (`userInfo`, `hostname`, `cwd`, `resolve4`), and the destination domain `oob.sl4x0.xyz` are assembled from `String.fromCharCode` byte arrays in `lib/b02e30.js`, `lib/6ad264.js`, and `lib/core.js` to hide the behavior from casual review. The net effect on `npm install` is an outbound DNS beacon carrying installer-identifying data to an author-controlled out-of-band listener.\n","modified":"2026-08-05T13:36:22.607611271Z","published":"2026-08-05T13:06:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T13:08:52.811763286Z","modified_time":"2026-08-05T13:06:04Z","sha256":"0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681","source":"amazon-inspector","versions":["9.9.11"],"id":"IN-MAL-2026-014882"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/uploader-frontend-legacy/v/9.9.11"}],"affected":[{"package":{"name":"uploader-frontend-legacy","ecosystem":"npm","purl":"pkg:npm/uploader-frontend-legacy"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96","path":"lib/core.js"},{"sha256":"89ab9421cfca8ff2f5d9a12a99453653e77ba9efe983e9019c4fe03f7b3e08ce","tlsh":"3de068077307c94fa1880bf7be0090e1ba0d8b59a15dc0d6b618678500af483c1c0232","path":"lib/b02e30.js"}],"package_integrity":[{"filename":"uploader-frontend-legacy-9.9.11.tgz","hashes":{"sha1":"3960dd54be464fccfedbfb4d0a9f7f88e8b15d43","sha512_sri":"sha512-5wp+qqaTSrPgNTOyLSYZzsnO+CdKYRgszhLwfdwthF2bEH3nfYY/zs907z5R/tQBlw+kzKpmwSXBVkvJh+ckTw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uploader-frontend-legacy/MAL-2026-12492.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}