{"id":"MAL-2026-17182","summary":"Malicious code in app-sca-info-banking (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b)\npackage.json declares scripts.postinstall: `node poc.js`, causing poc.js to execute automatically on npm install. poc.js issues DNS (dns.resolve4) and HTTP (http.get) callbacks to unique subdomains under ki6rmdjnq5q8y7v8soxc080fz65ytohd.oastify.com (a Burp Suite Collaborator / OAST host) and writes a marker file under os.tmpdir(). The package's main entry is an empty stub (module.exports = {}); the postinstall payload is the package's only functionality. The DNS/HTTP callbacks to an attacker-controlled OAST domain confirm arbitrary code execution on the installer's host and leak install-event metadata to a third-party endpoint.\n\n## Source: ossf-package-analysis (3f5e6f43a1552d09c016e2db6c287a1972a70df70fa7a42d3049840d04580bd4)\nThe OpenSSF Package Analysis project identified 'app-sca-info-banking' @ 0.0.24 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-09-25T14:30:06.229565265Z","published":"2026-09-25T08:35:37Z","database_specific":{"malicious-packages-origins":[{"versions":["0.0.24"],"import_time":"2026-09-25T08:46:58.101388316Z","modified_time":"2026-09-25T08:35:37Z","sha256":"3f5e6f43a1552d09c016e2db6c287a1972a70df70fa7a42d3049840d04580bd4","source":"ossf-package-analysis"},{"sha256":"9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b","source":"amazon-inspector","versions":["0.0.24"],"id":"IN-MAL-2026-020556","import_time":"2026-09-25T14:20:34.78312524Z","modified_time":"2026-09-25T14:10:07Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-sca-info-banking/v/0.0.24"}],"affected":[{"package":{"name":"app-sca-info-banking","ecosystem":"npm","purl":"pkg:npm/app-sca-info-banking"},"versions":["0.0.24"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-73q7FbCKm8MvCOzGwH6VzcE2x+wmhXUTCvP9st5a8q2OmaqGbiVcuG7bJT98JIDThqVHCfSg4JBibMKj/fBPzw==","sha1":"a2e407d5eaa0bde94f7f28659ae052efafa18fb8"},"filename":"app-sca-info-banking-0.0.24.tgz"}],"evidence_files":[{"sha256":"c5817444da50bd3e5696204ab5ca04cead18de598638ef2cc220042a5a9ec27a","tlsh":"f241dfc420f9603426bb088d6dbe18373917db527609b640358c426a8fcabd49e673fc","path":"poc.js"},{"path":"package.json","sha256":"345555687e06b03062050e1f4b471b6e7a8b82596a2fd5bd410c4a721f28315a","tlsh":"bdd02b2048204d2324c4aa080c675546b1614e2700087c0917e7582c87de13788ff20e"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-sca-info-banking/MAL-2026-17182.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}