{"id":"MAL-2026-17543","summary":"Malicious code in @inpeek/odata-angular (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65)\n@inpeek/odata-angular@99.99.102 is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated version (99.99.102) to win resolution against an internal package of the same name. package.json declares scripts.postinstall as 'node./ping.js'; ping.js issues an HTTPS GET to the third-party collector https://db1b65hgnouukn3qov9gta83zgkdao9dy.oast.me/ carrying os.hostname(), os.platform(), process.version, and the package name as query parameters. index.js throws on require, so the package has no legitimate library function; the only install-time effect is the beacon to the external OAST domain. Any CI job or developer workstation whose resolver picks @inpeek/* from the public registry executes the beacon on npm install and leaks host identifiers to an attacker-controlled destination, regardless of a 'bug bounty research' framing in the description.\n","modified":"2026-10-05T04:15:04.311569236Z","published":"2026-10-05T03:33:31Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-05T03:57:37.842446639Z","modified_time":"2026-10-05T03:33:31Z","sha256":"914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65","source":"amazon-inspector","versions":["99.99.102"],"id":"IN-MAL-2026-021001"},{"id":"IN-MAL-2026-021002","import_time":"2026-10-05T03:57:37.902989921Z","modified_time":"2026-10-05T03:33:45Z","sha256":"b087670a1a54b00b2f5ec4812c21fec9991085f53a853c0cbf58c429a5f54381","source":"amazon-inspector","versions":["99.99.101"]},{"source":"amazon-inspector","versions":["99.99.100"],"id":"IN-MAL-2026-021007","import_time":"2026-10-05T03:57:38.240488807Z","modified_time":"2026-10-05T03:34:30Z","sha256":"bffc00ade4411c7665473aa5b4802e3e57b9ac7e1f794088742cf18f80ac405f"},{"id":"IN-MAL-2026-021025","import_time":"2026-10-05T03:57:39.660141313Z","modified_time":"2026-10-05T03:37:23Z","sha256":"f43cb389d86a54240fbfc5670eda41079d21c5cffed36f36dfc25f5274c8e11e","source":"amazon-inspector","versions":["99.99.99"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inpeek/odata-angular/v/99.99.102"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inpeek/odata-angular/v/99.99.101"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inpeek/odata-angular/v/99.99.100"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inpeek/odata-angular/v/99.99.99"}],"affected":[{"package":{"name":"@inpeek/odata-angular","ecosystem":"npm","purl":"pkg:npm/%40inpeek/odata-angular"},"versions":["99.99.102","99.99.101","99.99.100","99.99.99"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"odata-angular-99.99.102.tgz","hashes":{"sha1":"2e924a917d2a4cba6db8caeab2f29d38b543ff4d","sha512_sri":"sha512-XlANCqmhtnhble32RUUyGMiFZC3pbTLqVG/1sE+Gh7A60031p4G0v0qYgSeVLiSd4Dm2ufyPOJnEdoGMJRkx1Q=="}}],"evidence_files":[{"tlsh":"923165bb2691437017e802e97355685a9687f11ad8516dc4b9cf12a84bc11eb22216f3","path":"ping.js","sha256":"78fb048f90c93454692a1e2e94d9bf46ad326d6a2185f77d65d0512cf7f47e59"},{"sha256":"13e86c3c0e553f6263d1bcc34b395a3cd2a7e9289fa93c8793f1008fe31eba09","tlsh":"26f00c6cd9649d7222ec4ae5083a0001f0292e8fd840bc0a3adb100d2b5e4eb52bc26e","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@inpeek/odata-angular/MAL-2026-17543.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}