{"id":"MAL-2026-5416","summary":"Malicious code in @klapp-otp/routes (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9246974efd1a626094dd3f2027df2e8f1468ce45ebcba42e5207a06c5c9e16ee)\nOn `npm install`, this package auto-executes `index.js` via the `preinstall` lifecycle hook. The script collects `os.hostname()`, `os.userInfo()`, `__dirname`, `process.cwd()`, and the package name, then exfiltrates them through two channels: (1) a hex-encoded DNS A-record query to `\u003cencoded\u003e.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (an interactsh out-of-band collector), and (2) an HTTP POST of the same JSON payload to `http://172.201.213.59:9090/c`. Both channels fire unconditionally on install, leaking installer identity to attacker-controlled infrastructure. The package metadata reinforces the dependency-confusion / namespace-squat shape: scope `@klapp-otp` with version `99.0.0` and the description string `security research`, paired with no legitimate functionality in the tarball.\n","modified":"2026-06-09T19:01:29.462191985Z","published":"2026-06-09T17:40:27Z","database_specific":{"malicious-packages-origins":[{"sha256":"3701ac552bd704a6c763558749e69755eadea825b90f0b0e51be120ed8bf2c01","import_time":"2026-06-09T17:45:54.738848321Z","id":"IN-MAL-2026-005100","modified_time":"2026-06-09T17:40:27Z","versions":["99.0.1"],"source":"amazon-inspector"},{"source":"amazon-inspector","sha256":"6eebbab7c031083ae325b2262558bb759840f96f356a54ac3df3b5e1fa70ae75","import_time":"2026-06-09T17:45:54.632506583Z","id":"IN-MAL-2026-005099","modified_time":"2026-06-09T17:40:27Z","versions":["99.0.1"]},{"source":"amazon-inspector","sha256":"8d3143a25bca88550c73189b84085b9a8770cace00d02790eb6c17520350f0bd","import_time":"2026-06-09T18:50:20.943812249Z","id":"IN-MAL-2026-005157","modified_time":"2026-06-09T17:57:07Z","versions":["99.0.0"]},{"source":"amazon-inspector","sha256":"9246974efd1a626094dd3f2027df2e8f1468ce45ebcba42e5207a06c5c9e16ee","import_time":"2026-06-09T18:50:20.861308077Z","id":"IN-MAL-2026-005156","modified_time":"2026-06-09T17:57:07Z","versions":["99.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@klapp-otp/routes/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@klapp-otp/routes/v/99.0.0"}],"affected":[{"package":{"name":"@klapp-otp/routes","ecosystem":"npm","purl":"pkg:npm/%40klapp-otp%2Froutes"},"versions":["99.0.1","99.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@klapp-otp/routes/MAL-2026-5416.json","indicators":{"package_integrity":[{"filename":"routes-99.0.1.tgz","hashes":{"sha512_sri":"sha512-7S4omY3pCYMB6kaXIQ4TWm4vdf3V90ZEPpuS1khtBZbLDC7RBNxoHtxYeI2zQUQGN6PdYqOSGsVi7k0ghlnpPw==","sha1":"04d8f4c40a6f2a925ac695fb5c2105814745676c"}}],"domains":["7b2268223a227363616e2d653837313737303965316235222c2275223a22.7363616e222c2264223a222f686f6d652f7363616e2f6e6f64655f6d6f64.756c65732f406b6c6170702d6f74702f726f75746573222c2263223a222f.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live"],"evidence_files":[{"sha256":"accf0cac5313b31906c51eac3c753c2c7213f044eca353b8ef03831c05b6672f","tlsh":"80f041e171b0d0f98b708580fdc46a8453b3d656b00288f0dc0d0fcf06c24d05c769e1","path":"index.js"},{"sha256":"4d26ceee5e41e2b885d99f5a5934d081edc3866e8e4725fcfa61fd389bf551f9","tlsh":"43c0807c3d31b476176183f46d756c4c71f9c65810d48e44cff6857454b17e8945e055","path":"package.json"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}