{"id":"MAL-2026-4694","summary":"Malicious code in tubebrain (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e4773b7c6b3832dbd9b733f1bbe60d85f6a85a0764ad0c43345962c09add1cca)\nlib/bootstrap.js contains a hardcoded outbound channel to https://transscendsurvival.org alongside calls to https://api.github.com and reads of process.env, with an https.get invocation at line 154. The transscendsurvival.org domain is not a documented vendor or publisher endpoint and matches the shape of an attacker-controlled C2/exfiltration host — pairing environment-variable reads with a hardcoded non-publisher destination is the canonical credential/secret-exfiltration pattern. Installing or loading this package routes installer-side environment data and GitHub API interactions through this third-party host.\n","modified":"2026-05-27T00:32:08.329072836Z","published":"2026-05-19T23:51:44Z","withdrawn":"2026-05-26T18:56:52Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-19T23:51:44Z","sha256":"e4773b7c6b3832dbd9b733f1bbe60d85f6a85a0764ad0c43345962c09add1cca","source":"amazon-inspector","versions":["0.1.10"],"id":"IN-MAL-2026-003304","import_time":"2026-05-26T05:50:23.300195735Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tubebrain/v/0.1.10"}],"affected":[{"package":{"name":"tubebrain","ecosystem":"npm","purl":"pkg:npm/tubebrain"},"versions":["0.1.10"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tubebrain/MAL-2026-4694.json","indicators":{"package_integrity":[{"filename":"tubebrain-0.1.10.tgz","hashes":{"sha1":"9316fd47541f2a06500bc884562b929493459373","sha512_sri":"sha512-oi3U233tfZ0d7zCT1vQ/KJzqAkb43juhR0RjGp4mdRtpzDKeQd0qWGA4pasairn3pGcD18ATZpNGmRLBVqwtWA=="}}],"evidence_files":[{"sha256":"9b960de152a917b72271dd59a83cc827f79bb2066a31edf89dd8f69b85ab7275","tlsh":"5e02a48959f366714223a2b4565fa906b3a78507310dce80fa9dc2a03f8133cdf67ad9","path":"lib/bootstrap.js"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}