MAL-2024-2031

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crosswalker/MAL-2024-2031.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-2031
Published
2024-06-25T12:34:37Z
Modified
2026-07-23T07:51:19.172628936Z
Summary
Malicious code in crosswalker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3)

package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, platform, arch, homedir, username, uid/gid, shell, OS info, cwd, and the output of whoami and id, then POSTs the JSON payload to a hardcoded URL at https://kbz9yyzq2mtljdwwf6r0tpzlfcl39txi.oastify.com/detox56. The destination is a Burp Collaborator subdomain — out-of-band infrastructure used to confirm exfiltration / RCE during dependency-confusion reconnaissance. Installer host and user identifiers leave the machine without consent on every install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2024-06-28T02:42:30.582944927Z",
            "modified_time": "2024-06-25T12:34:37Z",
            "sha256": "148095f56bec9386ec4bc32f297a96280fb3915ba079baf9c7d8a614cfb36233",
            "versions": [
                "1.0.1",
                "1.0.0"
            ],
            "id": "RLMA-2024-00647",
            "source": "reversing-labs"
        },
        {
            "import_time": "2024-10-24T00:57:40.422716816Z",
            "source": "reversing-labs",
            "sha256": "3836b56aa95dfca87e242dbd470349f3f9cf85007f4c9af2e333e7da622c99dc",
            "id": "RLUA-2024-06366",
            "modified_time": "2024-10-16T12:41:51Z"
        },
        {
            "import_time": "2026-06-23T19:40:41.593385812Z",
            "modified_time": "2026-06-23T19:34:10Z",
            "sha256": "b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3",
            "versions": [
                "18.2.1"
            ],
            "id": "IN-MAL-2026-007340",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-07-20T13:15:01.435782703Z",
            "source": "reversing-labs",
            "sha256": "97c0dfc8d1b2f9b65c1f0ae7d444e1c48a3fdfc21716f6618b4a887f1ebb0312",
            "versions": [
                "18.2.1"
            ],
            "id": "RLUA-2026-05525",
            "modified_time": "2026-07-20T10:38:40Z"
        }
    ]
}
References
Credits

Affected packages

npm / crosswalker

Package

Name
crosswalker
View open source insights on deps.dev
Purl
pkg:npm/crosswalker

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
18.*
18.2.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "145162c515f65a241ba7b8494a4f9002a327e0033509ee55bfcc8340af8977c9bf0bf6",
            "sha256": "9b80a5d44f4c34ba84fb8da5d6223810240ff1050ac2dacade7e4683216336b0",
            "path": "index.js"
        },
        {
            "tlsh": "d72288760912a800a723bdd54ee8ec5e25e8e47d621f683cf456efb62b8c14d5f1e123",
            "sha256": "5a80c722939ba6f3373043432a13cefcf6b36a52124ed1e6d261dbecd428953a",
            "path": "i"
        }
    ],
    "package_integrity": [
        {
            "filename": "crosswalker-18.2.1.tgz",
            "hashes": {
                "sha1": "c69b513408ce6c3738db322b76ebf9c61f41b9da",
                "sha512_sri": "sha512-StHn4KDn6zhFNxDpUn8UrN+6SEsYSxwx+U6iTkeKaFpOzGQmQCTdAn8cz3gYBfl4tD8MgkxcaZZlTHc4aB9qQg=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crosswalker/MAL-2024-2031.json"