{"id":"MAL-2026-6253","summary":"Malicious code in zomato-server (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f0a12373009dd17131e45f4d20570904f2b8074367ee8b121e60a3ce5764fa00)\nThe package's package.json declares a preinstall lifecycle hook that runs curl to POST the installer's hostname, whoami, current working directory, and a base64-encoded dump of the full process environment to http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site over plain HTTP. The destination is an Interactsh-style out-of-band collection subdomain unrelated to any legitimate Zomato infrastructure. This fires automatically on `npm install` without user consent, leaking any credentials, tokens, or secrets present in environment variables (CI tokens, npm auth, AWS keys, etc.). The package itself ships only a 62-byte stub index.js exporting { name, version } and impersonates the Zomato brand (description 'Zomato server-side utilities', repo pointing at github.com/zomato/zomato-server), consistent with a dependency-confusion lure targeting Zomato internal builds.\n\n## Source: ossf-package-analysis (f8a4a2681c8fa36379b138cad816cffb627b9e8095e5fe3cbd5a144075efe1da)\nThe OpenSSF Package Analysis project identified 'zomato-server' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-06-22T18:31:22.787014326Z","published":"2026-06-21T16:04:03Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-21T16:38:02.860619598Z","modified_time":"2026-06-21T16:04:03Z","versions":["1.0.0"],"source":"ossf-package-analysis","sha256":"f8a4a2681c8fa36379b138cad816cffb627b9e8095e5fe3cbd5a144075efe1da"},{"versions":["1.0.0"],"source":"amazon-inspector","sha256":"f0a12373009dd17131e45f4d20570904f2b8074367ee8b121e60a3ce5764fa00","import_time":"2026-06-22T18:25:28.886188488Z","id":"IN-MAL-2026-007148","modified_time":"2026-06-22T17:42:30Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zomato-server/v/1.0.0"}],"affected":[{"package":{"name":"zomato-server","ecosystem":"npm","purl":"pkg:npm/zomato-server"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"zomato-server-1.0.0.tgz","hashes":{"sha512_sri":"sha512-V8dfW3BMzzGkA/5syLmC11FzVQvsKEFQKijBPCuLG/5C5GxvzB/19ZEhFW+mJ4BpqPg923Pba/k2mnPUUJoZ5w==","sha1":"40f30b3393c7e50716df06149ee32553b379c4f0"}}],"evidence_files":[{"sha256":"b9028dfb3b4140b2d87815f6feb5d4f0232a5df2ef1fcb90f12b185f54bbccd6","tlsh":"ee01bd25b834d6737d8c4771bd66206a3e692f4f84346c045f9f011e838f215227e662","path":"package.json"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zomato-server/MAL-2026-6253.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}