{"id":"MAL-2026-5833","summary":"Malicious code in yunxin-overmind-comment (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc)\nOn `npm install`, the package's `scripts.postinstall` runs `src/_postinstall.js`, which spawns a detached Node child that collects the installer's hostname, username, platform/arch, cwd, Node version, npm registry, all non-internal IPv4 addresses, and the keys of environment variables matching /NPM|NODE|CI|JENKINS|GIT|BUILD|RUNNER|DOCKER|KUBE|REGISTRY/. The collected data is HTTPS-POSTed to a hardcoded DingTalk bot webhook (`https://oapi.dingtalk.com/robot/send?access_token=4e5cb67f...df393`). Before sending, the script checks the username and hostname against an analyst/sandbox keyword list (`sandbox`, `malware`, `analyst`, `cuckoo`, `analysis`, `sample`) and silently no-ops if any match — explicit anti-analysis evasion. The combination of automatic install-time execution, host/network reconnaissance scoped to CI/build runners, hardcoded attacker-controlled callback, and sandbox-evasion gating is the canonical dependency-confusion beacon shape. Installing this package leaks internal hostnames, IP topology, and CI/build environment fingerprints to the operator of the DingTalk webhook, enabling targeted follow-on attacks against the installer's internal infrastructure.\n","modified":"2026-06-15T20:31:52.925003205Z","published":"2026-06-15T20:11:26Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.2.0"],"id":"IN-MAL-2026-006704","import_time":"2026-06-15T20:14:29.574321648Z","modified_time":"2026-06-15T20:11:26Z","sha256":"57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/yunxin-overmind-comment/v/1.2.0"}],"affected":[{"package":{"name":"yunxin-overmind-comment","ecosystem":"npm","purl":"pkg:npm/yunxin-overmind-comment"},"versions":["1.2.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yunxin-overmind-comment/MAL-2026-5833.json","indicators":{"evidence_files":[{"tlsh":"da41b5e675a57638177c85c290821016da67e2223583f8e0fc2c41d61bc7cfa9af193e","path":"src/_postinstall.js","sha256":"d74886e20adaab3cbdb25d8f54ed4ed3a7f22c1d48e0e7ad80a740be9a238a1b"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-K6rMksJ/7gEdo+1pn238nUYBxfFvStI+Q+P6Z0DKlz79wi3obd2o5ZOY4lPfE8owEvse++PoEJYGh3faQkvvCA==","sha1":"3b76dd6b1b7ee4100b68bd16e51331383cd85765"},"filename":"yunxin-overmind-comment-1.2.0.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}