MAL-2025-49410

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/frontend-vue-next/MAL-2025-49410.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-49410
Aliases
  • GHSA-7492-2cqc-6827
Published
2025-11-09T00:17:09Z
Modified
2026-09-01T11:31:07Z
Summary
Malicious code in frontend-vue-next (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474)

package.json declares "preinstall": "node index.js", causing index.js to execute automatically on npm install. The script collects system identity (os.hostname(), os.userInfo() including username/uid/gid/shell, platform, arch, home directory, cwd, cpu/memory info) and executes shell commands whoami and id via child_process, then POSTs the aggregated JSON to a hardcoded URL https://7z7l0xz2ay3chokh48nrncmaz15stih7.oastify.com/testbydext. The destination is a Burp Suite Collaborator out-of-band subdomain — a throwaway, attacker-controlled listener used to capture exfiltrated data. The package metadata is empty (no author, no description, no repository), and the name rides on the Vue/Next.js namespace as a lure. Installing this package on a developer machine or CI runner leaks host and user identity to the attacker without consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-11-09T00:27:23.743441901Z",
            "modified_time": "2025-11-09T00:17:09Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "cc961cf637890bd581b7ba0471152cb4a26299f03fbfb467570044f52e7d094d",
            "source": "amazon-inspector"
        },
        {
            "id": "RLMA-2025-06356",
            "import_time": "2025-12-23T22:38:30.843243478Z",
            "modified_time": "2025-12-23T08:14:33Z",
            "sha256": "49cb9d3c09154d511f0abd850e746684a208e0d23a8aa2697ebb7c3fef9ebd15",
            "source": "reversing-labs",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-002757",
            "import_time": "2026-05-15T07:37:19.141621908Z",
            "modified_time": "2026-05-14T19:25:48Z",
            "sha256": "5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "id": "RLUA-2026-05098",
            "import_time": "2026-07-09T09:17:07.104335529Z",
            "modified_time": "2026-07-07T12:52:08Z",
            "sha256": "2c39f358d76e6324ebfd87bdb7cedf7560c2f8f3253e4af7f7eaf1934926d2c1",
            "source": "reversing-labs",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "id": "RLUA-2026-06249",
            "import_time": "2026-09-01T11:18:07.261576551Z",
            "modified_time": "2026-08-24T16:52:29Z",
            "sha256": "b3e6e49d8f65a9f03423578110e4432de1a761f746aceac3593f604861e6b75f",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / frontend-vue-next

Package

Name
frontend-vue-next
View open source insights on deps.dev
Purl
pkg:npm/frontend-vue-next

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "c1ede895eb539736a9b4104d9b19065ba4afc53cecd3932e4cdf715898f7fab5",
            "tlsh": "43513fc515f656251ba7a8494a4f9402b327e0033509ee55bfcc8740af9837c97f0bf6"
        },
        {
            "path": "package.json",
            "sha256": "714b280bddbcd6e4402a33df222a91796b9117c8c9d3af2d0487528a42edfbac",
            "tlsh": "65d05e304d21653365c102a64c6ba44762719e2f14043c08678b182c91ce7b798fe34d"
        }
    ],
    "package_integrity": [
        {
            "filename": "frontend-vue-next-1.2.0.tgz",
            "hashes": {
                "sha1": "ce998ee03f1de8a488fe674d0b127882ec0195d9",
                "sha512_sri": "sha512-ATC7pDq8clHEQa2H2VBhqFufCzT3dZWipp6qfoMMR36YJeNCp6CKtktJwancRAQuOyTnn+Itjfkoy7PSwjttDw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/frontend-vue-next/MAL-2025-49410.json"