{"id":"MAL-2026-16340","summary":"Malicious code in pf25262 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb)\nindex.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA{...} token or falls back to capturing document.cookie plus the response length, and redirects the browser to a hardcoded collector URL at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1/ with the captured data appended to the path. The package's entire shipped payload is this authenticated-session-data exfiltration snippet, sending same-origin credentials and cookies to an attacker-controlled webhook.site bin.\n","modified":"2026-09-21T04:00:05.815303488Z","published":"2026-09-21T03:31:42Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-21T03:31:42Z","sha256":"95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020236","import_time":"2026-09-21T03:46:38.594641107Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pf25262/v/1.0.0"}],"affected":[{"package":{"name":"pf25262","ecosystem":"npm","purl":"pkg:npm/pf25262"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"7bd20d3e6da545589ae78144bcc9be96a24a0bc5007ee95dc63f5fd9ad82a6ad","tlsh":"b9d0953313ba00441efb8145b52bf0c8f557d503cc4fe11943159d707f0041d59556d1"}],"package_integrity":[{"filename":"pf25262-1.0.0.tgz","hashes":{"sha1":"f99ccf10985bc13350766bd3a05cf195f9593a0b","sha512_sri":"sha512-oGb6wKdqDX/quoN9CE6W6+skGih5eLAj430t2pcajJiBJpY3IzM5mt7TCWbhG/RkPHAWXWtLd3LUGFw2z9tnpA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pf25262/MAL-2026-16340.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}