{"id":"MAL-2026-5297","summary":"Malicious code in consumerweb-authflow (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977)\nOn `npm install`, the package's postinstall.js collects host identifiers via `os.hostname()`, `os.userInfo().username`, `os.platform()`, and the current working directory, then POSTs them over HTTPS to `kd1tbfhej84bcqde44rq77o79yfp3gr5.oastify.com` (a Burp Collaborator out-of-band callback subdomain). The package's own metadata self-identifies as a dependency-confusion proof-of-concept (`description: \"Dependency confusion PoC - H1-lingtys\"`, payload tag `src: 'paypal-dep-confusion-poc'`), and the package name is chosen to collide with an internal/private package name so that misconfigured resolvers pull this public version instead. Regardless of bug-bounty intent, every installer's machine identity is leaked to an external attacker-controlled OAST endpoint without consent, automatically, on a default install.\n\n## Source: ossf-package-analysis (0a4795bc3b2c513417e92b1547d165f9b6cbb750f437b5bf3ac87e63832087ca)\nThe OpenSSF Package Analysis project identified 'consumerweb-authflow' @ 4.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-06-12T20:01:49.479633987Z","published":"2026-06-07T16:59:25Z","database_specific":{"malicious-packages-origins":[{"versions":["4.1.1"],"source":"ossf-package-analysis","sha256":"0a4795bc3b2c513417e92b1547d165f9b6cbb750f437b5bf3ac87e63832087ca","import_time":"2026-06-07T17:33:24.34930144Z","modified_time":"2026-06-07T16:59:25Z"},{"modified_time":"2026-06-07T17:35:34Z","versions":["4.1.3"],"source":"ossf-package-analysis","sha256":"6046f90089681a0351528c2aec67d71ba49df4e2fb98bc7ce59206d3a9e02de1","import_time":"2026-06-07T18:33:01.400688057Z"},{"id":"IN-MAL-2026-005254","modified_time":"2026-06-09T22:43:40Z","versions":["4.1.1"],"source":"amazon-inspector","sha256":"1dfe3a6140cb37159a3f0284f9e5977fc40e3bfe77b7d320e1e13d5cb55e75c1","import_time":"2026-06-09T23:32:25.412194835Z"},{"versions":["4.1.1"],"source":"amazon-inspector","sha256":"ae33044ec0b4ed91962290dba48f2643d92a9b625fcaa44dfbd7701af7b2fe95","import_time":"2026-06-09T23:32:25.472729184Z","id":"IN-MAL-2026-005255","modified_time":"2026-06-09T22:43:40Z"},{"modified_time":"2026-06-12T19:10:38Z","versions":["4.1.3"],"source":"amazon-inspector","sha256":"acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977","import_time":"2026-06-12T19:44:16.452737672Z","id":"IN-MAL-2026-006176"},{"versions":["4.1.3"],"source":"amazon-inspector","sha256":"d166b1a62988a2bd5649488117723a04bed050087a94f0994bb8343f6642a8d7","import_time":"2026-06-12T19:44:16.551990383Z","id":"IN-MAL-2026-006177","modified_time":"2026-06-12T19:10:39Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/consumerweb-authflow/v/4.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/consumerweb-authflow/v/4.1.3"}],"affected":[{"package":{"name":"consumerweb-authflow","ecosystem":"npm","purl":"pkg:npm/consumerweb-authflow"},"versions":["4.1.1","4.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["kd1tbfhej84bcqde44rq77o79yfp3gr5.oastify.com"],"evidence_files":[{"sha256":"9c1ee5a9da2f3c5d5a87a297d2cd64506644102fec6d0ed00de340bc96140ec3","tlsh":"60f08bf06271aa745fb991d8e0d498058173e150bc0bbce1bdc806a8abc9af815b4df4","path":"postinstall.js"}],"package_integrity":[{"filename":"consumerweb-authflow-4.1.1.tgz","hashes":{"sha1":"32b09884dcf5feb7b05befdc496d8b6b030c7dbe","sha512_sri":"sha512-eZf05XdyWCOf0Zu04EfP84uvX/Wzu+JQZ0maOgfn7apdJHb7ZmKGpTovUQwG3U2uaN3maa+v5+xakaX618oikg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb-authflow/MAL-2026-5297.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}