{"id":"MAL-2026-4804","summary":"Malicious code in @leviyuan/lodestar (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba)\nThe package ships a lifecycle-invoked script (dist/lodestar-setup.js) that performs an HTTP POST to a hardcoded https://open.feishu.cn endpoint, with process.env data referenced in the same file. dist/lodestar.js similarly contains multiple POST calls to the same Feishu infrastructure. The hardcoded third-party C2 destination (Feishu's open API, used as a webhook receiver) combined with environment-variable access is the canonical exfiltration shape: any developer or build system that installs this package will leak environment contents to the publisher's webhook. The package name (@leviyuan/lodestar) is also a scoped lookalike of the well-known Ethereum consensus client 'lodestar' from ChainSafe, which compounds the supply-chain risk by inviting confused installs.\n","modified":"2026-05-27T00:31:59.523864937Z","published":"2026-05-26T10:17:39Z","withdrawn":"2026-05-26T18:19:24Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-26T10:17:39Z","sha256":"8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba","source":"amazon-inspector","versions":["0.4.2"],"id":"IN-MAL-2026-004895","import_time":"2026-05-26T13:32:45.910447663Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@leviyuan/lodestar/v/0.4.2"}],"affected":[{"package":{"name":"@leviyuan/lodestar","ecosystem":"npm","purl":"pkg:npm/%40leviyuan%2Flodestar"},"versions":["0.4.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@leviyuan/lodestar/MAL-2026-4804.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"7cb744818def683ce70b7c4df9446cd4f03e66db","sha512_sri":"sha512-GbiV2JaLykqCZmEVkktMOEHRDcz2BcDzX+eyoR3fRmUFHrb/PVMzucIfWXQaVXxjSO49uzhBGnqsQiMY/75o2Q=="},"filename":"lodestar-0.4.2.tgz"}],"evidence_files":[{"path":"dist/lodestar-setup.js","sha256":"37d129b83725e1c424b265bcaefde298b81fa1c4a1af1c18230bca4d9b7768b2","tlsh":"9e424f58baec99743fae50acedc00117e1940e086e28e52671fd746e37f4a589ec273d"},{"path":"dist/lodestar.js","sha256":"6ccca47579af6376d028df911f153b4d10036a8a60ab8d5d417266728c3d076e","tlsh":"c18598e6ee1ef4514dbce561ebb32a506322f848b806105affd84cdbd298e44f1d6934"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}