MAL-2026-10181

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb/MAL-2026-10181.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10181
Published
2026-07-10T22:43:11Z
Modified
2026-07-23T07:51:17.262507065Z
Summary
Malicious code in consumerweb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7)

On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS servers from dns.getServers(), and package metadata) and exfiltrates it via DNS lookup and an HTTPS POST to a subdomain of oast.fun (interact.sh OAST collaborator). The package name and description ('Internal App bUg b0UntY gollum22 h1') indicate a dependency-confusion attempt targeting an internal package name; any successful install both confirms the internal name is squattable and leaks identifying information about the installer's environment to the attacker's collaborator. No installer opt-in, no legitimate use case for the collected data going to an OAST endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-10T22:50:18.993077685Z",
            "id": "IN-MAL-2026-009726",
            "sha256": "74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7",
            "versions": [
                "2200.4.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-07-10T22:43:11Z"
        },
        {
            "import_time": "2026-07-20T13:14:45.134105299Z",
            "id": "RLMA-2026-05521",
            "sha256": "87cc833287039635efd311bbe4ea455585c4d16ed331362cfa29b91d41d44680",
            "modified_time": "2026-07-20T10:38:09Z",
            "source": "reversing-labs",
            "versions": [
                "2200.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / consumerweb

Package

Name
consumerweb
View open source insights on deps.dev
Purl
pkg:npm/consumerweb

Affected ranges

Affected versions

2200.*
2200.4.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "4a415594854263204eb087d86911d40ef6a6db77318487a5f9ee4bc42f736b060b2dbc",
            "sha256": "c08be38bb6e1ba3768479d47f7ce329e377b784a3643df6c47fa0669d7c51290"
        },
        {
            "path": "package.json",
            "tlsh": "4be026324d225a3329f006d2886b9486b2a08f3f10349c07b1bf092ca1e323198cf71d",
            "sha256": "a1475d55065b992f6a47378f6fdc5fa20daef5e15719f16e8e872913b12a0e44"
        }
    ],
    "package_integrity": [
        {
            "filename": "consumerweb-2200.4.2.tgz",
            "hashes": {
                "sha1": "6be4db6804fce71edf5bd292b19cbe80449d309e",
                "sha512_sri": "sha512-GcpqV5o7Bc+/50ZA1QGh1hLKLwVI7cyeKPWSf/dfRNFpHWboE3WCu+THFZnnxjgIa/ueOF3bkSuJFUlydye1tA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb/MAL-2026-10181.json"