{"id":"MAL-2026-14019","summary":"Malicious code in fr-ito-web-react (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e)\nPackage's package.json declares both preinstall and postinstall lifecycle hooks that execute `node exfil.js` on npm install. exfil.js runs `whoami` and `id` via child_process.execSync and transmits the output to the hardcoded host `d9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site` over HTTPS POST with TLS verification disabled (`rejectUnauthorized: false`), with a DNS lookup fallback that encodes the whoami output as a hex subdomain of the same collector. The package uses version 99.99.99, a typical dependency-confusion cover version to force resolution over an internal package of the same name. Installer identity and host data leaves the machine to an attacker-controlled interactsh/OAST collector without user interaction.\n\n## Source: ossf-package-analysis (bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1)\nThe OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-08-14T14:46:34.686835253Z","published":"2026-08-14T06:50:50Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["99.99.99"],"import_time":"2026-08-14T07:36:27.928352726Z","modified_time":"2026-08-14T06:50:50Z","sha256":"bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1"},{"source":"amazon-inspector","versions":["99.99.99"],"id":"IN-MAL-2026-017725","import_time":"2026-08-14T14:28:03.194179008Z","modified_time":"2026-08-14T13:49:08Z","sha256":"1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fr-ito-web-react/v/99.99.99"}],"affected":[{"package":{"name":"fr-ito-web-react","ecosystem":"npm","purl":"pkg:npm/fr-ito-web-react"},"versions":["99.99.99"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fr-ito-web-react/MAL-2026-14019.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"fr-ito-web-react-99.99.99.tgz","hashes":{"sha1":"8cb36e5c7f3aa8504fdeb82bf46f66279befd26b","sha512_sri":"sha512-bSYpHnx/4i5sqklT5qHTKrX/qILGlptqniBuP5A0nwmZ7Rv3S/PhQSnggAJQqtQLhL9lB6KHx9cFkyvFNu/SnA=="}}],"evidence_files":[{"path":"exfil.js","sha256":"222ebe92d681b64f7b56b3ffaf639e05418b9921743759fcc6aa9e37cf57ddf0","tlsh":"c32187fa41f5b230e692b5d8714392a2b317d204b215dfe0914c42693f8e02982734fc"},{"path":"package.json","sha256":"1a74a2e6df9c62075984d914fbcf2af3040e1bbba5967de3365ac3f23763ad64","tlsh":"75d05e3009109a73bcc40aa5183a908b29a10d1b4248b820b7d3116582db7ba68bb35e"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}