{"id":"MAL-2026-16381","summary":"Malicious code in cisco-github-simple (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205)\nThe package declares a preinstall lifecycle hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp Collaborator subdomain prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com. The package name impersonates Cisco's GitHub namespace, consistent with a dependency-confusion recon beacon targeting internal Cisco builds. There is no legitimate purpose served by the code; installing or building against this package leaks sensitive host and account information to an attacker-controlled out-of-band domain.\n","modified":"2026-09-22T14:30:06.908069364Z","published":"2026-09-22T13:56:19Z","database_specific":{"malicious-packages-origins":[{"sha256":"2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-020284","import_time":"2026-09-22T14:19:07.634654822Z","modified_time":"2026-09-22T13:56:19Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cisco-github-simple/v/1.0.1"}],"affected":[{"package":{"name":"cisco-github-simple","ecosystem":"npm","purl":"pkg:npm/cisco-github-simple"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cisco-github-simple/MAL-2026-16381.json","indicators":{"package_integrity":[{"filename":"cisco-github-simple-1.0.1.tgz","hashes":{"sha1":"83b0eb6810a24b46ec5e35afe469a66ed5942d97","sha512_sri":"sha512-5bjQTPBe7k5nbAOcVjITN6idfOxKr4eKABSq51PjppsJXU9N6QOzB0NiQpcfp7LJtn5zNCAGmnxWXjFoVIQk1A=="}}],"evidence_files":[{"path":"index.js","sha256":"21b81e40ffe5e20981e5631c94020f737bfe0cd08d5c34adbed836b7779393fc","tlsh":"5b41259962d917330de210c0670c70802359f9777259a9d076cf43969f869f8b7316f3"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}