{"id":"MAL-2026-16271","summary":"Malicious code in test89078-auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573)\nThe package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name.\n","modified":"2026-09-17T23:30:06.510231805Z","published":"2026-09-17T23:12:41Z","database_specific":{"malicious-packages-origins":[{"versions":["99.99.99"],"id":"IN-MAL-2026-020140","import_time":"2026-09-17T23:14:58.454057745Z","modified_time":"2026-09-17T23:12:41Z","sha256":"c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test89078-auth/v/99.99.99"}],"affected":[{"package":{"name":"test89078-auth","ecosystem":"npm","purl":"pkg:npm/test89078-auth"},"versions":["99.99.99"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test89078-auth/MAL-2026-16271.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"3b0597e5ae4f88f7b3e5a35220a907b926c5c8e73c55da0c03ca4c796cf8cab7","tlsh":"dde0abf002a553343a2300ca9194215717d7e65e300ee596bcad839083c2ab4daa051b","path":"index.js"}],"package_integrity":[{"filename":"test89078-auth-99.99.99.tgz","hashes":{"sha1":"97f596996e24ea80fb181c247a83ae90596013b8","sha512_sri":"sha512-XfOwBnCnvU2SWA4mQ4IpVAceMvR6i7Jhk0Y1xvR5sqia5xfq+DNDpP+ilazErFcRZAHi4uEiHLvYdeMqDJgHHQ=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}