MAL-2026-10086

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dl-pp-latm/MAL-2026-10086.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10086
Published
2026-07-09T17:03:02Z
Modified
2026-07-09T17:31:53Z
Summary
Malicious code in dl-pp-latm (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716)

Package dl-pp-latm@80.4.2 registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers — os.hostname(), os.userInfo().username, os.homedir(), dns.getServers(), current working directory, and the full package.json — and transmits them via HTTPS POST and DNS lookup to an Interactsh-style subdomain 'bvfmpadujgjgmbtzeibiikzijuhmtd2rs.oast.fun'. The package name pattern and 'Internal App bUg b0UntY gollum22' description match a dependency-confusion probe targeting internal/private package names; any developer workstation or CI system that resolves this package leaks internal hostnames, usernames, and DNS configuration to a third-party OOB collector. This fires automatically on npm install without user interaction.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-009375",
            "import_time":  "2026-07-09T17:19:30.80729264Z",
            "modified_time":  "2026-07-09T17:03:02Z",
            "sha256":  "e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716",
            "source":  "amazon-inspector",
            "versions":  [
                "80.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dl-pp-latm

Package

Name
dl-pp-latm
View open source insights on deps.dev
Purl
pkg:npm/dl-pp-latm

Affected ranges

Affected versions

80.*
80.4.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "372af57e73c6d36ea2deb9fcafe7469c3a09849ef18e9ff2b894ba8e8cca425b",
            "tlsh":  "b7413398445163608eb187d86911d40af6a6eb7731c487a5f9fe47c02fb36b420b2dbc"
        },
        {
            "path":  "package.json",
            "sha256":  "21ff6f483981c8d7a11d2d40faae6c89704891f1886f493a50afb0aa93ae6d93",
            "tlsh":  "e7e026324c361a2329b006aa887ba956b2a08f3f10349c17b1bf092c91e323198de30d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "dl-pp-latm-80.4.2.tgz",
            "hashes":  {
                "sha1":  "2f08415098c1c436a3363ea25a98089761373f10",
                "sha512_sri":  "sha512-GErY71T3aJhA/iN4e7dhhAGjya+YmNbs+frbPQiFHkwUsODwz1w8ptwtZB1xnh6QnMxsOH6u9aXsbn7w29SVVA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dl-pp-latm/MAL-2026-10086.json"