{"id":"MAL-2026-14186","summary":"Malicious code in pump-segments-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5)\npackage.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info, output of whoami/uname/id/ps aux, cwd, package.json, node_modules listing, /etc/passwd, /etc/shadow, ~/.npmrc, and ~/.npm/_logs, and POSTs the collected data over plain HTTP to a hardcoded oastify.com (Burp Collaborator) subdomain. The package presents itself as a netbsd-x64 esbuild build, which does not match the observed behavior. The read of ~/.npmrc exposes any npm auth tokens present on the installer host, and /etc/shadow read attempts to exfiltrate local password hashes.\n","modified":"2026-08-19T00:30:14.777106191Z","published":"2026-08-18T23:56:38Z","database_specific":{"malicious-packages-origins":[{"versions":["20.1.1"],"id":"IN-MAL-2026-018233","import_time":"2026-08-19T00:21:11.412170018Z","modified_time":"2026-08-18T23:56:38Z","sha256":"838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pump-segments-sdk/v/20.1.1"}],"affected":[{"package":{"name":"pump-segments-sdk","ecosystem":"npm","purl":"pkg:npm/pump-segments-sdk"},"versions":["20.1.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-h6c9bawnPnB/n4Cgbuj6QToGL6do7xJrL2v1I6BeAQr8cxnsoUFG2sXc9dJfilB1cedLAgvMot8Ck4Wdkj9jyw==","sha1":"268088ccf39e6d8ed4ab240c90aacd17b3fa98e8"},"filename":"pump-segments-sdk-20.1.1.tgz"}],"evidence_files":[{"tlsh":"db6110e485b9023136b3d1e111570003bdb6d1733216eef076cc8a992f5bb2852b79ec","path":"index.js","sha256":"f43f439cf39e626e43dfae4d5a716099d040b9197264c12d761860c772116e7a"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pump-segments-sdk/MAL-2026-14186.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}