MAL-2025-6695

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amdocs-core-package/MAL-2025-6695.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-6695
Published
2025-08-01T17:28:53Z
Modified
2026-07-13T14:31:57Z
Summary
Malicious code in amdocs-core-package (npm)
Details

The package communicates with a domain associated with malicious activity.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1e196068c171b8528ec4f1f0db852ef32a7b530ecce14d79696a21c4f685c2c6)

The package declares a preinstall hook that runs index.js on npm install. index.js requires https and os, reads os.hostname(), and issues an https.request POST to a hardcoded *.oastify.com Burp Collaborator subdomain, additionally embedding the hostname into the DNS label of that subdomain for out-of-band capture. Package metadata is placeholder (empty description and author, version 11.11.11, name shaped like an internal 'amdocs' scope), consistent with a dependency-confusion payload targeting an internal namespace. Installing the package causes the installer's host identifier to leave the machine to an attacker-controlled collaborator domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010239",
            "import_time": "2026-07-13T14:19:33.148844612Z",
            "modified_time": "2026-07-13T14:00:58Z",
            "sha256": "1e196068c171b8528ec4f1f0db852ef32a7b530ecce14d79696a21c4f685c2c6",
            "source": "amazon-inspector",
            "versions": [
                "11.11.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / amdocs-core-package

Package

Name
amdocs-core-package
View open source insights on deps.dev
Purl
pkg:npm/amdocs-core-package

Affected ranges

Type
SEMVER
Events
Introduced
1.0.0

Affected versions

11.*
11.11.11

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "866e2619bd25d38ef7f75a1a689a46e11b4b8c0f907a978b32063213cb41a3f1",
            "tlsh": "b6f0ace0802bd3b08fb29bd4e1159a03d426d322b103496278f943c66bd2e799032cac"
        },
        {
            "path": "package.json",
            "sha256": "a43ef4b644489c0e58adfd92adb07e4acb86f3c008ea6de60777f861840c68f1",
            "tlsh": "aad02e345e10563324c00a62082aa45272e0df2f11083c0aa7cb283c92de67788ff30e"
        }
    ],
    "package_integrity": [
        {
            "filename": "amdocs-core-package-11.11.11.tgz",
            "hashes": {
                "sha1": "3667f557c431150c743158381911891fe8a50069",
                "sha512_sri": "sha512-n6F1OlUIuEU4s5WHuJZVZmoM0iPjLyzr6RxFnqbXExp9Z6P2KdvE9v3lHnVV5xpEAaxWtl6T6cw6s7q/3WDvRw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amdocs-core-package/MAL-2025-6695.json"