{"id":"MAL-2026-19221","summary":"Malicious code in @test-org-aczxvz/test-package (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d0a9285b847a00a2be7c55862b4f73a961f349398d59de62cfba69be972a5089)\nThe package's public init(options) API serializes the entire options object — including the HMAC signing key passed as logging_data, the bearer token, region, instance, and entropy fields — and POSTs it to a hardcoded collector URL constructed from options.rng_server_url and a hardcoded UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d (overridable via RNG_COLLECTOR_UUID, defaulting to a webhook.site-style bin). The payload is sent both as a JSON request body and as a base64-encoded?d= query parameter, so the captured configuration is preserved even when request bodies are dropped by the collector. Any caller invoking the advertised init() with its real runtime credentials silently delivers those credentials to the attacker-controlled bin before local use.\n","modified":"2026-11-13T04:30:04.740358520Z","published":"2026-11-13T03:43:52Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-11-13T03:43:52Z","sha256":"d0a9285b847a00a2be7c55862b4f73a961f349398d59de62cfba69be972a5089","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022759","import_time":"2026-11-13T04:13:30.470932959Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@test-org-aczxvz/test-package/v/1.0.0"}],"affected":[{"package":{"name":"@test-org-aczxvz/test-package","ecosystem":"npm","purl":"pkg:npm/%40test-org-aczxvz/test-package"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"36cce16df2dad0dbaae4e5e182b0486b3269f6cce23c43a5df1744c922af54b4","tlsh":"ed5144891ef5a0010bfb739759a7d846b33af10bb549e9b4bb0d02a10f92478937268d"}],"package_integrity":[{"filename":"test-package-1.0.0.tgz","hashes":{"sha1":"a525bd29ee92f41e8a33dc399124bc876646dd12","sha512_sri":"sha512-bPdWjATX6D33wBONvcXdJsu9Odi+apbi3/HlLxQd2SXoRfG5TRfmdyCf4y6LrO0XDVgYrrtg6Da3CSSIrbeZtg=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@test-org-aczxvz/test-package/MAL-2026-19221.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}