{"id":"MAL-2026-16351","summary":"Malicious code in @baanx/abis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b)\nPackage declares `scripts.install: node index.js`, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename (`process.cwd()`), joins them with a timestamp and the prefix `bxabis` under the suffix `oob.algamil7x.xyz`, and issues a `dns.resolve4` lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on `npm install` and again on `require`. The module names, method references (`_load('os')`, `_load('dns')`, `userInfo`, `hostname`, `cwd`, `resolve4`), the prefix `bxabis`, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry `telemetry`/`connectivity probe` cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library.\n","modified":"2026-09-21T17:45:06.303611231Z","published":"2026-09-21T17:15:31Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020263","import_time":"2026-09-21T17:38:31.674056583Z","modified_time":"2026-09-21T17:15:31Z","sha256":"647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b","source":"amazon-inspector","versions":["9.9.11"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@baanx/abis/v/9.9.11"}],"affected":[{"package":{"name":"@baanx/abis","ecosystem":"npm","purl":"pkg:npm/%40baanx/abis"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"abis-9.9.11.tgz","hashes":{"sha1":"9467fff23faf27f4a13db5422a7b3ed51e996b6d","sha512_sri":"sha512-L5KzeFHJlL12gkUX6WvUtXrbEEqopKRW4A6K4qWK0nXZwURwfbi+5W6mf9FnZY4sTuT2jbnEWh77OuSkOc/QgQ=="}}],"evidence_files":[{"path":"runtime/support/telemetry/probe/impl.js","sha256":"ae4b73688385daef20c226d80792a6c877557cdfce7a925c14da94b27454621c","tlsh":"a4119c5ab253d0cf23d04699391c53e1482d82d097dd11d2bbbc169ba28d7914ad3a66"},{"sha256":"f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1","tlsh":"73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0","path":"runtime/support/telemetry/probe/c7a1f4.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}