MAL-2026-10085

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dependency_confusions/MAL-2026-10085.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10085
Published
2026-07-08T09:58:20Z
Modified
2026-07-20T02:34:43.168217006Z
Summary
Malicious code in dependency_confusions (npm)
Details

The npm package dependencyconfusions version 99.9.9 performs install-time host fingerprint and project path exfiltration. package.json sets index.js as the package main entrypoint and defines postinstall: node index.js. During npm install, index.js builds a JSON payload containing the local username from os.userInfo().username, the current project path from INITCWD or process.cwd(), the hostname from os.hostname(), the first non-internal local IPv4 address from os.networkInterfaces(), the platform from os.platform(), and an install timestamp. It then sends that payload with https.request to a webhook.site endpoint. This leaks developer or CI host identity and project path context to an attacker-controlled endpoint without user consent and is typical dependency-confusion reconnaissance behavior.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c5eab14c78cbbb6e4b580162a242817f899f6529485cb7f9197b6dfe05a3413)

package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js collects the installer's OS username (os.userInfo()), hostname (os.hostname()), current working directory, local IPv4 address, and platform (os.platform()), then POSTs the collected fields as JSON to a hardcoded webhook.site endpoint (https://webhook.site/264e1903-28ea-48ea-8c55-be58c5a76791). Fires automatically as a lifecycle hook without user consent, matching the classic dependency-confusion reconnaissance beacon: the exfiltrated username/hostname/cwd/localIP reveal internal build hosts and internal package namespaces that an attacker uses to target follow-on dependency-confusion attacks against the victim's private registry.

Database specific 
{
    "iocs": {
        "domains": [
            "webhook.site"
        ],
        "urls": [
            "https://webhook.site/264e1903-28ea-48ea-8c55-be58c5a76791"
        ]
    },
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-09T17:19:20.907651463Z",
            "source": "amazon-inspector",
            "sha256": "2c5eab14c78cbbb6e4b580162a242817f899f6529485cb7f9197b6dfe05a3413",
            "versions": [
                "99.9.9"
            ],
            "id": "IN-MAL-2026-009302",
            "modified_time": "2026-07-09T16:34:18Z"
        }
    ]
}
References
Credits

Affected packages

npm / dependency_confusions

Package

Name
dependency_confusions
View open source insights on deps.dev
Purl
pkg:npm/dependency_confusions

Affected ranges

Affected versions

99.*
99.9.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "51110bb485b7a1102ab621d1480b98092626e103380bb9e83a4c83a49fc49fc59b2be8",
            "sha256": "4f2f78519b2c44b03bc6bedfab817816a17a49b8292f97a95792fda5a88a6fe5",
            "path": "index.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor",
        "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dependency_confusions/MAL-2026-10085.json"