{"id":"MAL-2026-4266","summary":"Malicious code in discovery-build (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c24a1e59b8c5d3ae1059499825bf47d1abe8d362ddefe264f1a429ed9e7e98cc)\npackage.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on `npm install`. The script collects host identifiers (os.hostname(), os.platform(), username, cwd), reads /etc/passwd via fs.readFileSync('/etc/passwd','utf8'), and bulk-enumerates the installer's environment variables (Object.entries(process.env).slice(0, 30)) — capturing whatever CI tokens, AWS credentials, npm tokens, or other secrets happen to be in scope. The collected data is POSTed as JSON over HTTPS to bl0oxto4g54mptbwu8q8i1r0mrsjgg45.oastify.com, a Burp Collaborator out-of-band testing subdomain controlled by whoever generated the payload. The package's self-description as a 'security research canary' does not change installer-side impact: any developer or CI pipeline that installs this package leaks host identity, /etc/passwd, and a slice of environment secrets to an external host without consent.\n\n## Source: ossf-package-analysis (122f28edfb2fdddb4059785146e58b64540086c0df37ced45b5bbc9d2dff926a)\nThe OpenSSF Package Analysis project identified 'discovery-build' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-05-26T06:02:30.400205341Z","published":"2026-05-23T15:56:25Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-23T17:00:59Z","versions":["1.0.1"],"source":"ossf-package-analysis","sha256":"122f28edfb2fdddb4059785146e58b64540086c0df37ced45b5bbc9d2dff926a","import_time":"2026-05-23T17:26:10.470314218Z"},{"sha256":"6f76708e3ff014efa97162fa2278d96f886348d836b3478b81c8025a8831d175","import_time":"2026-05-23T17:26:10.578145807Z","modified_time":"2026-05-23T17:18:07Z","versions":["1.0.3"],"source":"ossf-package-analysis"},{"versions":["1.0.1"],"source":"amazon-inspector","sha256":"0a14a42d0af8676cca2cf61f76d68c54cd26d272d999dc034afedc27dd1e572a","import_time":"2026-05-26T05:52:26.990294393Z","id":"IN-MAL-2026-004361","modified_time":"2026-05-23T16:16:39Z"},{"versions":["1.0.2"],"source":"amazon-inspector","sha256":"920fade0555e4d2637f9c27075d0731b8221d99cb64c6544f59bb21c9bcf7a78","import_time":"2026-05-26T05:52:27.487855841Z","id":"IN-MAL-2026-004365","modified_time":"2026-05-23T17:00:37Z"},{"id":"IN-MAL-2026-004363","modified_time":"2026-05-23T16:19:53Z","versions":["1.0.1"],"source":"amazon-inspector","sha256":"a96284a15ff7e94835c6bde07e06b9693481ee82776aedf14e2c3a15ee738037","import_time":"2026-05-26T05:52:27.21022477Z"},{"modified_time":"2026-05-23T17:03:26Z","versions":["1.0.3"],"source":"amazon-inspector","sha256":"b119b3cfa5bbb801aeff6835b8dd7ac5f7f37c6a31f90f09b4804aa121750f20","import_time":"2026-05-26T05:52:27.79362402Z","id":"IN-MAL-2026-004368"},{"import_time":"2026-05-26T05:52:25.804542925Z","id":"IN-MAL-2026-004351","modified_time":"2026-05-23T15:56:25Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"c24a1e59b8c5d3ae1059499825bf47d1abe8d362ddefe264f1a429ed9e7e98cc"},{"id":"IN-MAL-2026-004367","modified_time":"2026-05-23T17:03:26Z","versions":["1.0.3"],"source":"amazon-inspector","sha256":"d21d9aa255e209f19ceedc445ccd53c380a7375780c9df193217ed74099b1956","import_time":"2026-05-26T05:52:27.693683251Z"},{"modified_time":"2026-05-23T17:00:38Z","versions":["1.0.2"],"source":"amazon-inspector","sha256":"eb50290b5e0d715f1323ec943dd7aa02122bbe9b9172d945de70825f9cf89f75","import_time":"2026-05-26T05:52:27.596775946Z","id":"IN-MAL-2026-004366"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/discovery-build/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discovery-build/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discovery-build/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discovery-build/v/1.0.3"}],"affected":[{"package":{"name":"discovery-build","ecosystem":"npm","purl":"pkg:npm/discovery-build"},"versions":["1.0.1","1.0.3","1.0.2","1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"discovery-build-1.0.1.tgz","hashes":{"sha512_sri":"sha512-rCxHaZeLVx0J+Tux/KlFxdc1zEuzA/Uj50VS8QICKr5nWWRqE2yfSUodziqJnlAKJ52l6ZL+HiO/jesFwhzgfQ==","sha1":"a1686ed8ee5e85181fd9dc4ad9de2f0f66db6a8e"}}],"domains":["kf3xr2idaeyvj255ohkhcal9g0msasyh.oastify.com","scan.kf3xr2idaeyvj255ohkhcal9g0msasyh.oastify.com"],"evidence_files":[{"sha256":"120130f07c55a2ca5a55abcfa8bf2ae304aa451cecd9f6d690ca6d23494f344d","tlsh":"fd0120f153f0e6b058e30dc0e66588167127e0003305b9e039ac92656b8aeb846f2cec","path":"postinstall.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discovery-build/MAL-2026-4266.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}