{"id":"MAL-2026-16174","summary":"Malicious code in alkajsdfoiwqeusdflkjsdf (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c9c1a2da5555fcd5b4350c7adf91acc2730d3afe436979553905ab3a28cd5877)\nPackage declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, homedir, DNS servers, cwd, and the full package.json, and POSTs them to https://l2ha5tswnm71286wnjgrngvb4tyejmdpe.i.dr0gas.com via https.request. It additionally serializes the entire process.env with JSON.stringify(process.env) and POSTs it to the same host's /exf path via fetch. On CI and developer machines the environment routinely contains credentials (npm/AWS/GCP tokens, CI secrets), so this bulk env transmission constitutes credential harvesting. The package name and behavior are consistent with a dependency-confusion beacon.\n","modified":"2026-09-15T16:31:08.841206571Z","published":"2026-09-15T15:55:44Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020066","import_time":"2026-09-15T16:19:15.884945829Z","modified_time":"2026-09-15T15:55:44Z","sha256":"c9c1a2da5555fcd5b4350c7adf91acc2730d3afe436979553905ab3a28cd5877","source":"amazon-inspector","versions":["3.7.3"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/alkajsdfoiwqeusdflkjsdf/v/3.7.3"}],"affected":[{"package":{"name":"alkajsdfoiwqeusdflkjsdf","ecosystem":"npm","purl":"pkg:npm/alkajsdfoiwqeusdflkjsdf"},"versions":["3.7.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/alkajsdfoiwqeusdflkjsdf/MAL-2026-16174.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6686205b181b18a3839a1d52ee768f85d0f80d4af5aa1981d4db7a58f3c9e3e3","tlsh":"5e4194c848f222340e7f64d8a69ea409565ade27b80ddcd4fa5e47c05fc97bc1531af2"}],"package_integrity":[{"filename":"alkajsdfoiwqeusdflkjsdf-3.7.3.tgz","hashes":{"sha512_sri":"sha512-OSumBZOsgmJQ3gm4EK74g2nXU6XNx4cX5tPxoG/k7Fj3gEQehNLCEUGY7t9d4lK8s7j+IrozVbrjZxk9kOHAqQ==","sha1":"8a3e462045ab311670a220100c8182eecf559c91"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}