{"id":"MAL-2026-18439","summary":"Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2)\nThe package's `prepare` lifecycle script executes `node index.js`, which reconstructs the hostname `npmp19n5--768.oob.awss.dev` by joining a string array and issues a DNS lookup via `require('dns').lookup(...)`. The destination is an out-of-band application-security-testing callback host carrying a unique per-package label, so installing the package confirms code execution on the installer's machine to the operator of that domain. The hostname is assembled from an array of fragments at runtime rather than appearing as a plain literal, concealing the destination from static scanners. The package provides no legitimate functionality consistent with a lifecycle-time DNS callback to an external token-bearing host.\n","modified":"2026-11-02T02:30:04.937359033Z","published":"2026-11-02T01:50:19Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022479","import_time":"2026-11-02T02:17:04.542985446Z","modified_time":"2026-11-02T01:50:19Z","sha256":"66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@an1mshnpmb9c84920/pipeprobe-obf-m19n5/v/1.0.0"}],"affected":[{"package":{"name":"@an1mshnpmb9c84920/pipeprobe-obf-m19n5","ecosystem":"npm","purl":"pkg:npm/%40an1mshnpmb9c84920/pipeprobe-obf-m19n5"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e0bb38786bbe3e826ddd73fe8c59441594f381187ef64e281a33c594da3ae502","tlsh":"35b09b4d4410925513268067d374475a98f7fbc155448055f534cc99125547596d5494"}],"package_integrity":[{"filename":"pipeprobe-obf-m19n5-1.0.0.tgz","hashes":{"sha512_sri":"sha512-RFCuhOfazZV78RAvB7uYTbE+CE+C/nHPQd7a5G8NKrhJ3pQ6RCItQOmJ/mgWXJ/N1bzKN2ecE6tPrq/Yp2Ym/A==","sha1":"8df2c8b6764af33bc2167ff40363f4eeedf1ba3f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@an1mshnpmb9c84920/pipeprobe-obf-m19n5/MAL-2026-18439.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}