{"id":"MAL-2026-6291","summary":"Malicious code in @outmarket/ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e)\npackage.json declares a postinstall script that runs automatically on `npm install` and performs `require('https').get(...)` to a Burp Collaborator subdomain (`7rzjsf29azci2qjsm6kxt23ag1mtanyc.oastify.com`), passing `os.hostname()` and `os.userInfo().username` as query parameters. Any developer or build system installing this package leaks host identity to an external attacker-controlled OAST endpoint. The package's own description (`PENTEST-PoC: Dependency confusion - SecurifyAI engagement 2026-06-23`) and the version `9.9.9` published under the `@outmarket` scope indicate the package is designed to win resolution against an internal private package of the same name and harvest beacons from anyone in the targeted organization who installs it.\n","modified":"2026-06-23T14:31:20.913969463Z","published":"2026-06-23T14:12:09Z","database_specific":{"malicious-packages-origins":[{"versions":["9.9.9"],"id":"IN-MAL-2026-007207","import_time":"2026-06-23T14:23:03.488562279Z","modified_time":"2026-06-23T14:12:09Z","sha256":"7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@outmarket/ui/v/9.9.9"}],"affected":[{"package":{"name":"@outmarket/ui","ecosystem":"npm","purl":"pkg:npm/%40outmarket%2Fui"},"versions":["9.9.9"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"f79b34aef25edb1847146983030a7f634d11cbcad642562ea4bc89b86c9f60d8","tlsh":"9de068f849fcf77238c408c954b22a0cb4b3d9255008ac04aae3228886941f75eb167a"}],"package_integrity":[{"filename":"ui-9.9.9.tgz","hashes":{"sha512_sri":"sha512-cZrM6s3n5KxN3lF10sD/pQ0AhJ3lxvIotf6KXHUTdBY7Cd4ZUHzBg88jVpBX0mwAOrEZJN/CgX9kyI/mf+vsdQ==","sha1":"4ee5f7f689d4bcc02eed83edb3a778f02bd336ae"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@outmarket/ui/MAL-2026-6291.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}