{"id":"MAL-2026-15549","summary":"Malicious code in ckeditor5-ckbox (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7)\nUnscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook (`node index.js`) that runs on `npm install`. index.js collects installer machine identifiers — os.hostname(), os.userInfo() (username, uid, gid, shell), platform/arch, home directory, cwd, and the output of `whoami` and `id` executed via child_process — and POSTs the JSON to the hardcoded Burp Collaborator OAST domain https://shdu19bid9mc4e6lezjmldk0erki88wx.oastify.com/system-info. The package contains no CKEditor functionality; the sole payload is the install-time beacon. Author/description are empty and the name is a typosquat of the scoped legitimate package.\n","modified":"2026-08-29T02:30:12.882136086Z","published":"2026-08-29T02:15:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-29T02:22:21.681581921Z","modified_time":"2026-08-29T02:15:04Z","sha256":"9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7","source":"amazon-inspector","versions":["5.0.0"],"id":"IN-MAL-2026-019147"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ckeditor5-ckbox/v/5.0.0"}],"affected":[{"package":{"name":"ckeditor5-ckbox","ecosystem":"npm","purl":"pkg:npm/ckeditor5-ckbox"},"versions":["5.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"ckeditor5-ckbox-5.0.0.tgz","hashes":{"sha1":"e069ddf549893986b518e601ac14465b19373b55","sha512_sri":"sha512-x2znUEEf7uzHBgNLZMfxVOo7gm6nLusyV2jaXtkzmN7mQWoPWxn9ubcJfcln3BdZ63i2O2l2KL9SN2Ukqzw73g=="}}],"evidence_files":[{"sha256":"dabe680d43c5cbf486d25209f227743df93b5f7e891251d220fe918c9f999d0b","tlsh":"b5513fc516f65a251ba7a8494a0f9402a327e0033549ee55bfcc8740af9936c9bf0bf6","path":"index.js"},{"path":"package.json","sha256":"04c4ecd2cea2132b3b2fc181d00c67dbf32b7ad76734c5f12409ad2f3882221c","tlsh":"aed02e300d21582325d00692086eb04262a08f2f1a043808a3cb283ca0ef6b3acff30d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ckeditor5-ckbox/MAL-2026-15549.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}