{"id":"MAL-2026-12792","summary":"Malicious code in gs-uitk-testing-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300)\ngs-uitk-testing-utils@9.9.11 declares an npm install lifecycle script (scripts.install='node index.js') that loads lib/core.js. That module collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), and the basename of the current working directory (process.cwd()), joins them with a hardcoded campaign marker 'goldman2' and a timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz, leaking host-identifying data over DNS. The destination domain, the target module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd'), and the marker are reconstructed at runtime from char-code arrays in lib/b02e30.js and lib/6ad264.js to hide them from static inspection. The package name mimics an internal 'gs-uitk-*' UI-toolkit namespace and pairs with the marker 'goldman2' and an author email at the same sl4x0.xyz domain used for exfiltration, consistent with dependency-confusion reconnaissance against a specific organization. The exfiltration fires automatically on `npm install` and on require of the package.\n","modified":"2026-08-05T14:37:13.699427291Z","published":"2026-08-05T13:35:32Z","database_specific":{"malicious-packages-origins":[{"sha256":"58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300","source":"amazon-inspector","versions":["9.9.11"],"id":"IN-MAL-2026-014983","import_time":"2026-08-05T14:19:49.257258354Z","modified_time":"2026-08-05T13:35:32Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gs-uitk-testing-utils/v/9.9.11"}],"affected":[{"package":{"name":"gs-uitk-testing-utils","ecosystem":"npm","purl":"pkg:npm/gs-uitk-testing-utils"},"versions":["9.9.11"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-u0ryGj5J3TxrY5xf6U6o89Fw+C7gZg/2nmgq1o4ESh0uvx2F3/IEFhVdGeQyreZ5OEjFwz5nC07IevoOgbLdZQ==","sha1":"210b144754273b929951744bd803d77c67faf150"},"filename":"gs-uitk-testing-utils-9.9.11.tgz"}],"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"sha256":"3c8602d2046a6084ade4805b7b9a1e408de72dddf34e5cb592ad3b2c70c12baa","tlsh":"ffe068073313c94fa1880bf77d0060a0aa0d8f58a16dc0daba28678601bf447d1c0232","path":"lib/b02e30.js"},{"path":"package.json","sha256":"74cffce7e9adf29dae95e834b3451961985e86b3d6fd0f8f6fde3f7101da64f2","tlsh":"ef21a035ce254c232ec82964ac692a42f1a24c174d407c1937c7513c8faf16f11ff61d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gs-uitk-testing-utils/MAL-2026-12792.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}