{"id":"MAL-2026-14531","summary":"Malicious code in analytics-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982)\nOn npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction.\n","modified":"2026-08-26T14:30:12.521140115Z","published":"2026-08-26T14:18:17Z","database_specific":{"malicious-packages-origins":[{"sha256":"a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982","source":"amazon-inspector","versions":["4.0.0"],"id":"IN-MAL-2026-018751","import_time":"2026-08-26T14:20:36.907679691Z","modified_time":"2026-08-26T14:18:17Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/analytics-v2/v/4.0.0"}],"affected":[{"package":{"name":"analytics-v2","ecosystem":"npm","purl":"pkg:npm/analytics-v2"},"versions":["4.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e3cf31b58720bdcab864d101d372cce245fd591c4de90df22b787b9644352e8e","tlsh":"99513ec516f655251ba7a8494a0f9002a327e0033609de55bfcc8340af9836c9bf0bf6"}],"package_integrity":[{"filename":"analytics-v2-4.0.0.tgz","hashes":{"sha512_sri":"sha512-0NE9spyiripI0WYGvoTvuqCq1epwStsfSGwMsQexoI0I9vpwXcheZOpk8O39sRAd5tP660fLHpEBfCyKpzfxmA==","sha1":"94c96f53fe4903efc35f8b20cc78ed35e502cbed"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/analytics-v2/MAL-2026-14531.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}