{"id":"MAL-2026-19226","summary":"Malicious code in quickgreet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b)\npackage.json declares a postinstall lifecycle script that runs an inline Node command reading os.hostname() and issuing an HTTP GET to \u003chostname\u003e.\u003csubdomain\u003e.oast.fun. The oast.fun service is an out-of-band interaction / callback collector used to confirm code execution and enumerate reachable installer environments; the hostname is embedded in the DNS label so it is captured by the operator's interactsh listener. The script performs no build, native-compile, or install task — its sole effect is to exfiltrate an installer identifier to an attacker-controlled OOB endpoint on every npm install.\n","modified":"2026-11-13T04:30:05.698978446Z","published":"2026-11-13T03:54:05Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022764","import_time":"2026-11-13T04:13:31.009783436Z","modified_time":"2026-11-13T03:54:05Z","sha256":"430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b","source":"amazon-inspector","versions":["0.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/quickgreet/v/0.0.2"}],"affected":[{"package":{"name":"quickgreet","ecosystem":"npm","purl":"pkg:npm/quickgreet"},"versions":["0.0.2"],"database_specific":{"indicators":{"evidence_files":[{"path":"package.json","sha256":"9d01124b0267be983a95b29c1e42278d232b6927b3a66b521a5341232bd6b69a","tlsh":"c0e07df80b90db3b21c00ee546ab8167f733c85150456a00f3b711aa06d83a25c7e489"}],"package_integrity":[{"hashes":{"sha1":"108902ca26abb96da12320fd373cbb17893ac187","sha512_sri":"sha512-ehQL9/d25CK/aoZGDfNKccginkvhJTgyB1PuGs1h1lPUvC8ISuAdrPW7oPzOxWs+4lwbgWpfSuJ3M3AsOuhX8g=="},"filename":"quickgreet-0.0.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/quickgreet/MAL-2026-19226.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}