{"id":"MAL-2026-6127","summary":"Malicious code in @onum-releases/utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8)\nOn require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.\u003chostname\u003e.200majoeu01dk02xnjdajro1isojc90y.oastify.com', leaking the installer's hostname via DNS and HTTP to an out-of-band collaborator endpoint controlled by the package publisher. The beacon fires unconditionally on module load, so any consumer that imports the package exposes its host identifier to the attacker-controlled collaborator. The package.json description claims 'Security PoC placeholder - benign, no runtime payload', directly contradicting the shipped code. The scope '@onum-releases' impersonates the Onum vendor namespace, consistent with a dependency-confusion lure aimed at that organization's developers.\n","modified":"2026-06-18T17:16:48.201356545Z","published":"2026-06-18T16:15:26Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-18T17:08:47.550328116Z","modified_time":"2026-06-18T16:15:27Z","sha256":"057e9534a55fd4068aaffb080224c08a14689dedbeb0737bda03a4c3bbc14a63","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-007002"},{"id":"IN-MAL-2026-007001","import_time":"2026-06-18T17:08:47.431910813Z","modified_time":"2026-06-18T16:15:26Z","sha256":"887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8","source":"amazon-inspector","versions":["1.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/utils/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/utils/v/1.0.2"}],"affected":[{"package":{"name":"@onum-releases/utils","ecosystem":"npm","purl":"pkg:npm/%40onum-releases%2Futils"},"versions":["1.0.1","1.0.2"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"17a8dbe1504773d6f3bbe29b27a7c2cde02b26c2c486887038bcdcba5fa89f85","tlsh":"8ff0dce592b5f4507232a4c8d20e90096293e0802280ced0419ed0e05da1a681702ef8"}],"package_integrity":[{"filename":"utils-1.0.1.tgz","hashes":{"sha1":"97a07d7682334b9d831a20dff1fbe412df8128de","sha512_sri":"sha512-VxYgIbqPKFaRFhZZxN+6vEK8mjmBkMzOfdYavryA4G/LaVVOVMNZ7Agv3KPk+jIX1GlXWHgs8MD4WVddAu373g=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@onum-releases/utils/MAL-2026-6127.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}