{"id":"MAL-2026-6238","summary":"Malicious code in atlasora-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5)\npackage.json declares \"postinstall\": \"node install.js\", which runs automatically on npm install. install.js requires https, fs, os, and child_process; collects host identifiers via os.hostname() and os.userInfo(); invokes execSync() to gather additional system data; checks for sensitive files via fs.existsSync(); and POSTs the collected data over an https.request() to a hardcoded remote endpoint. This is the canonical install-time system-information exfiltration shape: any developer or CI machine that runs `npm install atlasora-client` will silently leak host identity, user account info, and reconnaissance data about local filesystem contents to an attacker-controlled destination.\n","modified":"2026-06-20T13:46:43.746647524Z","published":"2026-06-20T13:10:03Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007094","import_time":"2026-06-20T13:37:51.004020105Z","modified_time":"2026-06-20T13:10:03Z","sha256":"fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/atlasora-client/v/1.0.0"}],"affected":[{"package":{"name":"atlasora-client","ecosystem":"npm","purl":"pkg:npm/atlasora-client"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff","path":"install.js","sha256":"5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88"},{"path":"package.json","sha256":"782c26c852740ff7a2ab03dceb60018bc24307b521ea586bd3f2fca78a7462ba","tlsh":"e4e0e5706e2088735ac9a6ad8da6914676314e0bc4487c1d3ac7205c97de6320afda2d"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-NnpCy9feNH/GeZ6NhBofP5lwWroCNIN0CMqeu8saHJmYe0EHlvdSmFpXZRAOhpP60oNF6F4TFqq14r3OXYF9JQ==","sha1":"631a9607e1d5033651ecb4f83e881492bbc5e1fe"},"filename":"atlasora-client-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-client/MAL-2026-6238.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}