{"id":"MAL-2026-12796","summary":"Malicious code in messenger-style (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10)\nThe package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.\n","modified":"2026-08-05T14:37:15.857501350Z","published":"2026-08-05T13:18:24Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T14:19:47.551653501Z","modified_time":"2026-08-05T13:18:24Z","sha256":"48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-014966"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/messenger-style/v/1.0.1"}],"affected":[{"package":{"name":"messenger-style","ecosystem":"npm","purl":"pkg:npm/messenger-style"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/messenger-style/MAL-2026-12796.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"messenger-style-1.0.1.tgz","hashes":{"sha512_sri":"sha512-ukrk9WgR4OYXOyIxZOuZyrUdZP9VcjJpZFL6cY60ZqjNeUlTwMljjV2FsmNoKcWPtmjXgqOXbBZ2lLyr0qygCQ==","sha1":"406b89c9b49b7134dbfa6efd620a7a5e87edb627"}}],"evidence_files":[{"path":"index.js","sha256":"d5430414b2826cc5db00f9f5ae556e542997c6c46d3bd7f2b440c0d2f5de4514","tlsh":"ae41259992d917330de210c0660c70843359fa777259999076cf42d6af869f8b7326f3"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}