MAL-2024-1783

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/auth0.net/MAL-2024-1783.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-1783
Published
2024-06-25T12:28:41Z
Modified
2026-06-12T20:01:47Z
Summary
Malicious code in auth0.net (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1)

On npm install, package.json's preinstall (and preupdate/test) hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun is the Project Discovery interactsh out-of-band callback service used to confirm code execution on victim hosts via a unique DNS subdomain. Firing automatically on install leaks the installer's existence and the corporate DNS resolver's egress IP to an attacker-controlled nameserver, with the unique subdomain serving as a per-victim correlation token. The package itself is hollow — index.js is empty, description is the placeholder 'Internal package', and author is 'Team' — and the package name auth0.net impersonates the Auth0 brand, consistent with a dependency-confusion attempt against an internal Auth0/.NET package name. The DNS beacon is the recon stage of that attack: the operator learns which organizations have misconfigured their registry resolution to pull this public package instead of an internal one, enabling targeted follow-on compromise.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2024-00377",
            "import_time":  "2024-06-28T02:41:58.280270208Z",
            "modified_time":  "2024-06-25T12:28:41Z",
            "sha256":  "31fb618f0bf6bb37e60f2a94d7ae0fb90ca439b8e141db9520a006242a335b55",
            "source":  "reversing-labs",
            "versions":  [
                "7.22.1"
            ]
        },
        {
            "id":  "RLUA-2024-06178",
            "import_time":  "2024-10-24T00:57:33.083069669Z",
            "modified_time":  "2024-10-16T12:32:48Z",
            "sha256":  "a033bb29ca10ee2dc795b9b881533ca73ab35ca29f4f421f7871a6057ac58ecf",
            "source":  "reversing-labs"
        },
        {
            "id":  "IN-MAL-2026-006011",
            "import_time":  "2026-06-12T19:43:58.081815234Z",
            "modified_time":  "2026-06-12T19:07:20Z",
            "sha256":  "299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1",
            "source":  "amazon-inspector",
            "versions":  [
                "39.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / auth0.net

Package

Name
auth0.net
View open source insights on deps.dev
Purl
pkg:npm/auth0.net

Affected ranges

Affected versions

7.*
7.22.1
39.*
39.1.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "4f2814c71c35935d40e487c11fa11c8aeac4367a61a85e8d9301ba6c3b6ebb7b",
            "tlsh":  "3ae09b268d51ec731ff006eb6566050671a3ee1a40218eca74f6860ce29b7d39c27614"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "auth0.net-39.1.0.tgz",
            "hashes":  {
                "sha1":  "e03c15154a7206bd83e5a088f1c14c5e5e9c07b9",
                "sha512_sri":  "sha512-QgWbEunF/eyYm24C4hyUQj1IOwfh0UiG+Sr6DsrkB9xkLjdm9uAEVs6HiK8pPb/xpfHA1gwcEXYGAf0/QKyZlA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/auth0.net/MAL-2024-1783.json"