{"id":"MAL-2026-5411","summary":"Malicious code in @klapp-about/routes (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (715f07e0a1984fc9eb7d6432fc2491b08139755426b3c8905ba2d9274e2d4875)\nOn `npm install`, the package's `preinstall` hook (`node index.js`) collects host and user identity data — `os.hostname()`, `os.userInfo().username`, `__dirname`, `process.cwd()`, pid, node version, platform, and architecture — and ships them to two attacker-controlled destinations: (a) an HTTP POST to a bare IP `http://172.201.213.59:9090/cb/klapp-about-routes` carrying the collected fields as JSON, and (b) a hex-encoded DNS lookup to `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (interactsh out-of-band callback). The package name `@klapp-about/routes` and the unusually high version `99.0.0` are the canonical shape of a dependency-confusion attack — an internal-looking scope published to public npm at a version high enough to override a private resolver. Self-description as a 'security research / dependency-confusion PoC' does not change installer-side impact: any developer or CI system that misroutes installs to the public registry has their machine fingerprint shipped to the hardcoded IP and DNS callback service without consent.\n","modified":"2026-06-09T19:01:27.923365022Z","published":"2026-06-09T17:35:19Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-09T17:45:54.508315496Z","id":"IN-MAL-2026-005097","modified_time":"2026-06-09T17:40:05Z","versions":["99.0.1"],"source":"amazon-inspector","sha256":"3a89d8d92c1d5303d17c64a14353dfd86d738d620129a830af3684b6ab2e2167"},{"source":"amazon-inspector","sha256":"99d2936e8940c6e62254cb8aefb5220dad856de80e50243788f3282e17035c10","import_time":"2026-06-09T17:45:52.935484151Z","id":"IN-MAL-2026-005074","modified_time":"2026-06-09T17:35:19Z","versions":["99.0.2"]},{"modified_time":"2026-06-09T17:35:19Z","versions":["99.0.2"],"source":"amazon-inspector","sha256":"dd5d030db916b2c1fcac6ca8ebaa5415eae8a32ad67a5104b78a17d535111a10","import_time":"2026-06-09T17:45:52.886613792Z","id":"IN-MAL-2026-005073"},{"source":"amazon-inspector","sha256":"fbc76fb74ca69f4553d9ffdb5b337805879b2a9d689fef836fb3b23e18a34482","import_time":"2026-06-09T17:45:54.579342445Z","id":"IN-MAL-2026-005098","modified_time":"2026-06-09T17:40:06Z","versions":["99.0.1"]},{"import_time":"2026-06-09T18:50:18.788106852Z","id":"IN-MAL-2026-005138","modified_time":"2026-06-09T17:52:45Z","versions":["99.0.0"],"source":"amazon-inspector","sha256":"715f07e0a1984fc9eb7d6432fc2491b08139755426b3c8905ba2d9274e2d4875"},{"sha256":"d37bd4622a778532f5476c87ebbe915d7d07d5ae30bf817d52ebdad17154c789","import_time":"2026-06-09T18:50:18.853693386Z","id":"IN-MAL-2026-005139","modified_time":"2026-06-09T17:52:46Z","versions":["99.0.0"],"source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@klapp-about/routes/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@klapp-about/routes/v/99.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@klapp-about/routes/v/99.0.0"}],"affected":[{"package":{"name":"@klapp-about/routes","ecosystem":"npm","purl":"pkg:npm/%40klapp-about%2Froutes"},"versions":["99.0.1","99.0.2","99.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"routes-99.0.1.tgz","hashes":{"sha1":"740674f10549deb94a448b586c23b976144e9b59","sha512_sri":"sha512-TtRL1zAkKP/fMvdKJxX4Unalt95prA5tvPH3TdkLJ/gyAyknyhXKtZsfTjjAAb+WgrCFs5NV1AG8keNiQ+/qcA=="}}],"domains":["7b2268223a227363616e2d396530326561666136653039222c2275223a22.7363616e222c2264223a222f686f6d652f7363616e2f6e6f64655f6d6f64.756c65732f406b6c6170702d61626f75742f726f75746573222c2263223a.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live"],"evidence_files":[{"tlsh":"bff0e1d112b0e0584b7154d0eaaba9451373c6127002c8f0ec8d07ce1fc69e0ccb35e6","path":"index.js","sha256":"cab3a2defa8489a4f078f69b759a16eb5354512c53b99509db67bbeb8e30b814"},{"tlsh":"fcd0a7745c34503314d592b60c75540a7171cd1e10547c4d9b9b141851ebb7354bb24d","path":"package.json","sha256":"d3957ed5741f98aea3d6479e0f505f844c6b30a68e65f2046acbb768a8814cc8"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@klapp-about/routes/MAL-2026-5411.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}