{"id":"MAL-2026-14237","summary":"Malicious code in gaarf-bq (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0)\nOn npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and POSTs them to a hardcoded endpoint at vpx0x956.instances.poc.jchunt.top (path /gaarf-bq) via https.request. The destination is not caller-configurable and is not related to any documented purpose of the package. The package name resembles Google's ads-api-report-fetcher (gaarf) BigQuery component, consistent with dependency-confusion scaffolding that lures internal builds into resolving this public name and beaconing back host fingerprints. A self-description as a security-research canary does not change the observed behavior: installer-owned identifiers leave the machine to an author-controlled host without opt-in.\n","modified":"2026-08-19T04:00:16.908651786Z","published":"2026-08-19T03:48:25Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018338","import_time":"2026-08-19T03:49:31.048642106Z","modified_time":"2026-08-19T03:48:25Z","sha256":"841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gaarf-bq/v/1.0.0"}],"affected":[{"package":{"name":"gaarf-bq","ecosystem":"npm","purl":"pkg:npm/gaarf-bq"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"17d68acc5a2cfeb9b7b80d337da5f33611463335234aeca36ff3bbddf52accb1","tlsh":"8401d3d5d1b95a7557f8629068f0af0693fbf223370624b67ac454e92f8d1f5003119d","path":"postinstall.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-ydFpDxt5v8cEZ3DkYDHdpNAFlgmxuGnmfh5sO5FAbFIE9GwlldLutw100KukRmSUCzj4UPjCuukXS5Z6hwUfJg==","sha1":"ba8af3ee332f063283de570669d16e8947d5b3cf"},"filename":"gaarf-bq-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gaarf-bq/MAL-2026-14237.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}