{"id":"MAL-2026-18187","summary":"Malicious code in simplewave (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0)\nsimplewave@0.0.2 declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun with the installer's os.hostname() embedded as the leftmost DNS label. oast.fun is the public Interactsh out-of-band interaction server, used to receive exfiltrated data via DNS/HTTP callbacks. The beacon fires unconditionally on npm install, with no caller consent or configuration. The shipped index.js is a trivial stub providing no advertised functionality, so the manifest-level beacon is the package's entire effect. The host identifier of every machine that installs the package is delivered to a third-party OOB collector controlled by whoever provisioned the oast.fun subdomain token.\n","modified":"2026-10-22T06:45:05.827762247Z","published":"2026-10-22T06:10:14Z","database_specific":{"malicious-packages-origins":[{"versions":["0.0.2"],"id":"IN-MAL-2026-021566","import_time":"2026-10-22T06:30:23.52812547Z","modified_time":"2026-10-22T06:10:14Z","sha256":"d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simplewave/v/0.0.2"}],"affected":[{"package":{"name":"simplewave","ecosystem":"npm","purl":"pkg:npm/simplewave"},"versions":["0.0.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"e8471246cd57d1305b12c3523851f05178e56bbd2d2ab43c181179308b66d643","tlsh":"4ce02df80f80db3b60c40ee406a78026f323c80200042a00e3fb11aa02d82f20c3e48c","path":"package.json"}],"package_integrity":[{"filename":"simplewave-0.0.2.tgz","hashes":{"sha512_sri":"sha512-evpJRFgOF3WjrXTV1n+6Ad0pKHFnp+kE1BBZErY7voT58oBBhMEtpksG8wi1Doy9uIKzTT1bNcbcHoV+gHACoA==","sha1":"5a97802b03f92a9f0fb4dcce29e11adbd742c174"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simplewave/MAL-2026-18187.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}