{"id":"MAL-2026-6249","summary":"Malicious code in blinkit-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8)\nOn `npm install`, the package's `preinstall` lifecycle hook runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/` and POSTs the installer's hostname (`hostname -f`), current user (`whoami`), working directory, and a base64-encoded dump of the entire process environment (`env | base64 -w0`) — which on CI/build hosts routinely contains tokens, cloud credentials, and registry auth. The package itself is hollow: `index.js` only exports `{ name, version }` and provides no functionality. The `repository.url` claims `git+https://github.com/zomato/blinkit-core.git` while publishing under that internal-sounding name on the public registry, matching the canonical dependency-confusion attacker shape against Zomato's internal `blinkit-core` namespace. Installer harm: any build pipeline that resolves this public package instead of an internal mirror leaks host identity and the full environment (including secrets) to the attacker's out-of-band interaction listener at install time, before any other code runs.\n\n## Source: ossf-package-analysis (304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15)\nThe OpenSSF Package Analysis project identified 'blinkit-core' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-06-23T17:01:25.053455027Z","published":"2026-06-21T16:21:08Z","database_specific":{"malicious-packages-origins":[{"sha256":"304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15","source":"ossf-package-analysis","versions":["1.0.0"],"modified_time":"2026-06-21T16:21:08Z","import_time":"2026-06-21T16:38:03.090942785Z"},{"sha256":"2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8","source":"amazon-inspector","id":"IN-MAL-2026-007258","versions":["1.0.0"],"modified_time":"2026-06-23T16:00:45Z","import_time":"2026-06-23T16:54:12.249149923Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/blinkit-core/v/1.0.0"}],"affected":[{"package":{"name":"blinkit-core","ecosystem":"npm","purl":"pkg:npm/blinkit-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-3OUMGcv04HfBHcYNX4ZckP+B+PiahD/UmgexEwgB3/yH00vPDFhUDyXm2uQxeBKdxwCEUwU27SLWI5rbstnlcQ==","sha1":"5b3f91486a814516afcca3e7a8a4f44ae6591183"},"filename":"blinkit-core-1.0.0.tgz"}],"evidence_files":[{"tlsh":"0201c964793892733d8c4374f936002ab8b16f0f84742c04df9b011c434f715663ea27","sha256":"22c96127b73579bc7e83350f8103221d2b73b0eaa6f58714ae3e2f5a366f1dc9","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/blinkit-core/MAL-2026-6249.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}