{"id":"MAL-2026-4682","summary":"Malicious code in tango-app-api-trax (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e7d8f3ef8e6fa016bfc17617ebcedce012c6cce870d89564965a476c3ec8da1c)\nThe tarball contains live, importable credentials for systems other than the installer's own. src/controllers/internalTrax.controller.js hardcodes Lenskart POS authentication (username `tango.eye`, password `55eyetango123`, header `X-Lenskart-API-Key: valyoo123`) inside the exported controllers `aomupdateCollection` and `saleUpdateCollection`, which post to `webservice.pos.lenskart.com` and `central.pos.lenskart.com`. Any consumer of this npm package can use these credentials to authenticate to Lenskart's production POS API as the `tango.eye` partner and read or mutate employee/store data. Additionally, `fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json` ships a complete Google Cloud service account (`project_id: tango-trax`, `client_email: firebase-adminsdk-k7lom@tango-trax.iam.gserviceaccount.com`) including the `BEGIN PRIVATE KEY` block, granting Firebase Admin privileges over the `tango-trax` GCP project to anyone who pulls the package. There are no install-time lifecycle hooks; the harm is the redistribution of usable third-party credentials, not auto-execution. The `ping` matches in the static analysis are unrelated string occurrences in the controller and not exfiltration behavior.\n","modified":"2026-06-26T12:26:01.949570969Z","published":"2026-05-20T11:24:49Z","withdrawn":"2026-06-18T19:50:12Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003521","modified_time":"2026-05-20T11:28:53Z","versions":["3.9.10"],"source":"amazon-inspector","sha256":"591ab6cb5c137b1fefb34181907f9b9eb7d798262aadf1d09ac5e936d469d110","import_time":"2026-05-26T05:50:47.112157677Z"},{"id":"IN-MAL-2026-003520","modified_time":"2026-05-20T11:24:49Z","versions":["3.9.10"],"source":"amazon-inspector","sha256":"5c14d60a97b056e00cb3055bd07605c2f16482794e5860fee68cab46f308893d","import_time":"2026-05-26T05:50:46.993714311Z"},{"versions":["3.9.43"],"source":"amazon-inspector","sha256":"4c8a53d02c48fb2675fdafcb4bedc1a372ffec81f4b51e5a947587ff9bd7c8d0","import_time":"2026-06-12T19:43:46.93326654Z","id":"IN-MAL-2026-005913","modified_time":"2026-06-12T19:04:44Z"},{"import_time":"2026-06-12T19:43:46.810086937Z","id":"IN-MAL-2026-005912","modified_time":"2026-06-12T19:04:43Z","versions":["3.9.39"],"source":"amazon-inspector","sha256":"56ff749fcfeb03bfd58b84b3f6a525d1cfc13c3c0c9bc6f433be5a87c47ee82a"},{"id":"IN-MAL-2026-005908","modified_time":"2026-06-12T19:04:40Z","versions":["3.9.21"],"source":"amazon-inspector","sha256":"6f73fa77749a62c88ad6af00fead67036139af36f0396fc49e33e0e46b3465db","import_time":"2026-06-12T19:43:46.421159582Z"},{"id":"IN-MAL-2026-005910","modified_time":"2026-06-12T19:04:42Z","versions":["3.9.32"],"source":"amazon-inspector","sha256":"73b67187cfd04d79bb02a0caa5abbb5933425803dd317eb58d30fa9f9d817667","import_time":"2026-06-12T19:43:46.622064305Z"},{"versions":["3.9.32"],"source":"amazon-inspector","sha256":"883f56cb8e1659025ca618281b73f32936557ff10e794e837bac3604ff4eae08","import_time":"2026-06-12T19:43:46.533219552Z","id":"IN-MAL-2026-005909","modified_time":"2026-06-12T19:04:41Z"},{"modified_time":"2026-06-12T19:04:45Z","versions":["3.9.43"],"source":"amazon-inspector","sha256":"e434eeea1e86591e8b74ef3db615d94fa39cc931756cc1d6f3ad0e614c465364","import_time":"2026-06-12T19:43:47.043383845Z","id":"IN-MAL-2026-005914"},{"modified_time":"2026-06-12T19:04:43Z","versions":["3.9.39"],"source":"amazon-inspector","sha256":"e7d8f3ef8e6fa016bfc17617ebcedce012c6cce870d89564965a476c3ec8da1c","import_time":"2026-06-12T19:43:46.718354218Z","id":"IN-MAL-2026-005911"},{"id":"IN-MAL-2026-005907","modified_time":"2026-06-12T19:04:39Z","versions":["3.9.21"],"source":"amazon-inspector","sha256":"0817dca8f1b99d1569ea4cd127a509e41e922c518356eeaae071a70585840f12","import_time":"2026-06-12T19:43:46.307105922Z"},{"id":"IN-MAL-2026-006688","modified_time":"2026-06-15T19:51:09Z","versions":["3.9.45"],"source":"amazon-inspector","sha256":"5c83c2a0f33cb7c69d2bc22cf4fe27db725e1f6507b4dd3e53fb27b1247e0f89","import_time":"2026-06-15T20:14:27.899469605Z"},{"modified_time":"2026-06-15T19:51:09Z","versions":["3.9.47"],"source":"amazon-inspector","sha256":"deb6a7f427c5a783c85ec35bb7cc43c33922a1fb5303ff90e50991057c323f0f","import_time":"2026-06-15T20:14:27.807545212Z","id":"IN-MAL-2026-006687"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.43"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.39"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.45"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tango-app-api-trax/v/3.9.47"}],"affected":[{"package":{"name":"tango-app-api-trax","ecosystem":"npm","purl":"pkg:npm/tango-app-api-trax"},"versions":["3.9.10","3.9.43","3.9.39","3.9.21","3.9.32","3.9.45","3.9.47"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["34.7.16.104.in-addr.arpa","github.com","release-assets.githubusercontent.com","storage.googleapis.com"],"evidence_files":[{"tlsh":"9e41eab30a84a1e38a7081e21a0ae617b5555f2d1f19a8ee53f600b0dcc9be9111f742","path":"fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json","sha256":"1665a44f88c2bedd03ba4123af91ec2ce38d87ea908b6bd3258f190e96f40ce1"}],"package_integrity":[{"filename":"tango-app-api-trax-3.9.10.tgz","hashes":{"sha512_sri":"sha512-SZqZsjKxX/XdkW4UjhHMV3j9yLIiYGRp2moMmPbfl+k9/xBA+pwHvEIP/9qUh+TW2xHTCuIgj6QDf+14ygI18w==","sha1":"a98e4697332d4385a6222734a9cedb6db97cbd94"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tango-app-api-trax/MAL-2026-4682.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}