{"id":"MAL-2026-18433","summary":"Malicious code in @axon-web/icons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (579025dc4de76ecd9400215e99d550cb4579ab6eb7d78e4c3c91a2299ff59c91)\nOn require, index.js constructs an identifier from os.hostname() and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh/OAST out-of-band collector — leaking the installer's hostname and OS username to an attacker-controlled DNS server as a side effect of module load. The same file enumerates process.env keys matching /token|secret|key|pass|aws|github|npm/i and writes the matching key names to stdout, which is reconnaissance of credential-bearing environment variables. The package presents as an icons library at version 99.0.0 with no icon content, consistent with a dependency-confusion or typosquat payload rather than a legitimate library.\n","modified":"2026-11-01T08:30:04.580317524Z","published":"2026-11-01T08:02:02Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["99.0.0"],"id":"IN-MAL-2026-022474","import_time":"2026-11-01T08:14:47.534932062Z","modified_time":"2026-11-01T08:02:02Z","sha256":"579025dc4de76ecd9400215e99d550cb4579ab6eb7d78e4c3c91a2299ff59c91"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@axon-web/icons/v/99.0.0"}],"affected":[{"package":{"name":"@axon-web/icons","ecosystem":"npm","purl":"pkg:npm/%40axon-web/icons"},"versions":["99.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@axon-web/icons/MAL-2026-18433.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"6b47accdd0db2d559cfbb7d2d3771112d710b39eb7930137868030007fdfb30b","tlsh":"b211ef8dd9fca37533a296c0b81904033abbef632581e420341c93965bd1a10832187d","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"9829db2d9cbc9401e75ffeb4902427763228774b","sha512_sri":"sha512-V4/eyUCjuDEFqijKoolkyHiIEHtE9Ht3EVdS9D86C6K+757BPwx05RBD42L9ynL8HWMVpqAcZ0QJScJbmMe+ew=="},"filename":"icons-99.0.0.tgz"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}