{"id":"MAL-2026-13481","summary":"Malicious code in cdf-tag-commander-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae)\nThe preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami` and `hostname`, retrieves the machine's public IP via ifconfig.me, and issues a plain-HTTP GET to a hardcoded Interactsh-style out-of-band callback subdomain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun), passing the three values as query parameters. The README states that the package makes no network requests, which contradicts the shipped code. The behavior is a reconnaissance beacon consistent with dependency-confusion targeting: on install, an attacker learns which internal build hosts and user accounts have resolved this package name.\n","modified":"2026-08-07T01:19:48.368246907Z","published":"2026-08-06T23:55:50Z","database_specific":{"malicious-packages-origins":[{"sha256":"945179057c5bd93b985c3c532baa35379ce9dd9603e26d17e63201beb25868ae","source":"amazon-inspector","versions":["3.6.2"],"id":"IN-MAL-2026-016851","import_time":"2026-08-07T00:59:21.810273287Z","modified_time":"2026-08-06T23:55:57Z"},{"import_time":"2026-08-07T00:59:21.727968778Z","modified_time":"2026-08-06T23:55:50Z","sha256":"ccd31e8393ef0a473c2e445bbd2132361c509f8679338b7a98fd4d9097b17db3","source":"amazon-inspector","versions":["3.1.1"],"id":"IN-MAL-2026-016850"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdf-tag-commander-helper/v/3.6.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdf-tag-commander-helper/v/3.1.1"}],"affected":[{"package":{"name":"cdf-tag-commander-helper","ecosystem":"npm","purl":"pkg:npm/cdf-tag-commander-helper"},"versions":["3.6.2","3.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdf-tag-commander-helper/MAL-2026-13481.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"scripts/preinstall.js","sha256":"4275061552723f1d31253e74f931ebac93d9f83b772b3c68a53374c1b4c9dd68","tlsh":"6d01f9f7636553f04fc2cd96854eb58b5317a12a7502bca87cbd0a563b49c0c13f22d5"}],"package_integrity":[{"filename":"cdf-tag-commander-helper-3.6.2.tgz","hashes":{"sha1":"ba23f21f8de10419940693d76fa1cce8e9013952","sha512_sri":"sha512-fa7pbmsjOFsJetUAPGON51kyJoxoRr8BZ6HBjKP5t95oCIgEV98RBhtHHIGfMWZP1ZyENN4iY1loAfsZceRGRg=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}