{"id":"MAL-2026-4569","summary":"Malicious code in gator-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1925735d02fb91f74a11718c3402ad0b10f551eecb8c6d88f02d475b3e0a799f)\nOn `npm install` (via scripts.install: `node index.js`) and on every `require('gator-client')`, lib/core.js collects `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, then issues a `dns.resolve4()` query for `lwgator.\u003cuser\u003e.\u003chost\u003e.\u003ccwd\u003e.\u003cts\u003e.oob.sl4x0.xyz`, leaking installer host identifiers over DNS to an attacker-controlled out-of-band domain. The function name `resolve4`, the module names `os`/`dns`/`process`, and the C2 domain `oob.sl4x0.xyz` are stored as decimal byte arrays in lib/b02e30.js and lib/6ad264.js and decoded via `String.fromCharCode` at runtime (paired with hex-style identifiers like `_0x5b3d`) to evade naive string scanners. The package's advertised purpose (\"Enterprise-grade utilities with enhanced validation and compatibility layer\") is a cover story: src/ ships plausible-looking benign modules, but the only code reached from the install hook and main entry is the beacon. The author email `research@sl4x0.xyz` matches the exfil domain `sl4x0.xyz`, confirming attacker ownership of the receiving infrastructure. DNS-based exfiltration is specifically chosen to bypass HTTP egress filters that would otherwise block outbound POSTs.\n","modified":"2026-05-26T06:02:21.385692769Z","published":"2026-05-20T13:17:53Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003544","import_time":"2026-05-26T05:50:49.719884767Z","sha256":"1925735d02fb91f74a11718c3402ad0b10f551eecb8c6d88f02d475b3e0a799f","modified_time":"2026-05-20T13:17:53Z","versions":["9.9.11"],"source":"amazon-inspector"},{"id":"IN-MAL-2026-003545","import_time":"2026-05-26T05:50:49.889537832Z","sha256":"82a9b9bbbc91bb4f55b84e72bc8735b30d4090baf79501f92acb96a5ec54348e","modified_time":"2026-05-20T13:17:53Z","versions":["9.9.11"],"source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gator-client/v/9.9.11"}],"affected":[{"package":{"name":"gator-client","ecosystem":"npm","purl":"pkg:npm/gator-client"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gator-client/MAL-2026-4569.json","indicators":{"domains":["lwgator.scan.scanae7ef43eac8.gatorclient.1779283023.oob.sl4x0.xyz"],"evidence_files":[{"tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96","path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4"},{"tlsh":"bee068173303c94fa1d80bf7790050a0aa1d8f58a11dc0d6b618678500af443c1c0632","path":"lib/b02e30.js","sha256":"8c5723763a4041fdd9b114b9754ad5d941532906ce6eac1d70efbd3fae6555f6"},{"tlsh":"65216622de254c333ed82a91ec696942f46208174d457c0a77c2913c8faf2af12ff61d","path":"package.json","sha256":"10f39cfd7ea2e41e2f7a771eae27f314c79f56c005cd26a59c476fead570dc74"}],"package_integrity":[{"hashes":{"sha1":"671d11ffa4fc8badec7d8a850e23e0b85d4e650b","sha512_sri":"sha512-6MAxzjfOv6V72a+I44oVXtEmvchp813QmnvjIHztRrt/73T6YF0GbG1FjG/iKR6S9P8fwqCLhJ2K2u5SL5cr7A=="},"filename":"gator-client-9.9.11.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}