{"id":"MAL-2026-16350","summary":"Malicious code in bnppf-flag-icons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78)\nThe package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on `npm install`. poc.js requires `os` and `https`, reads `os.hostname()` and `os.userInfo().username`, and sends them via HTTPS GET to a hardcoded webhook.site collector at https://webhook.site/f3d7a882-435a-4959-a4e9-18a3886f3447. The package name suggests a flag-icons library but the shipped code performs only host identifier exfiltration to an anonymous third-party collector; the version 99.99.99 is consistent with a dependency-confusion attempt. Installing the package causes the installer's hostname and OS username to be transmitted to an attacker-controlled endpoint.\n","modified":"2026-09-21T17:30:05.326779432Z","published":"2026-09-21T16:41:57Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["99.99.99"],"id":"IN-MAL-2026-020261","import_time":"2026-09-21T17:14:24.386258555Z","modified_time":"2026-09-21T16:41:57Z","sha256":"689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnppf-flag-icons/v/99.99.99"}],"affected":[{"package":{"name":"bnppf-flag-icons","ecosystem":"npm","purl":"pkg:npm/bnppf-flag-icons"},"versions":["99.99.99"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"bnppf-flag-icons-99.99.99.tgz","hashes":{"sha512_sri":"sha512-PIzrIEVkxK16NC7bC/kNsxjVSEeXfIWMcc0Dmp73cNe2bGKz3sMaLkvsNGPNvCzK8MxKdWDxLeWlMBz5klXzgg==","sha1":"2314dd80f36fc561f504b05b491e367f7a927555"}}],"evidence_files":[{"tlsh":"92f0a3f077b09f301d2cc4d053c6648ae263f21238677bd2595d62950f555b02de76b9","path":"poc.js","sha256":"570b63608fcd4534d17f7df694418c1ec7acca0bd67337ce2bbc64152d7f2703"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnppf-flag-icons/MAL-2026-16350.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}