MAL-2025-889

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/x509-escaping/MAL-2025-889.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-889
Published
2025-02-03T17:06:31Z
Modified
2026-09-18T20:45:06Z
Summary
Malicious code in x509-escaping (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731)

package.json declares preinstall: node index.js, so on npm install the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2025-00423",
            "import_time":  "2025-02-03T18:38:04.174023283Z",
            "modified_time":  "2025-02-03T17:06:31Z",
            "sha256":  "6150f863fcd7f7c787080f68ad3ce92693dbde72ba3dc5988151cec8c5f99578",
            "source":  "reversing-labs",
            "versions":  [
                "0.0.0",
                "0.0.1",
                "0.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-020189",
            "import_time":  "2026-09-18T20:38:13.921745248Z",
            "modified_time":  "2026-09-18T20:25:23Z",
            "sha256":  "a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / x509-escaping

Package

Name
x509-escaping
View open source insights on deps.dev
Purl
pkg:npm/x509-escaping

Affected ranges

Affected versions

0.*
0.0.0
0.0.1
0.0.2
1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "81f55a1213ee2e67da43780b25c0734a6a5f90e9b67fc440ab68464b79a08619",
            "tlsh":  "d9412395a2d917330dd210c06a0c70843359fa777159e99076cf42979f869f8bb326f3"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "x509-escaping-1.0.1.tgz",
            "hashes":  {
                "sha1":  "e5980ec78ef7404cf6f01aa7aaf22c7db050f5e4",
                "sha512_sri":  "sha512-PkiKcoazyFitKmcsA3kgWo3ysZU5L2X8G6zC9qZdTu0r1nkdO3axp1Wg9bS8tPoeSf9k2QWbznJHXOwClyMw9A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/x509-escaping/MAL-2025-889.json"