MAL-2026-10458

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/compliancepolicyserv/MAL-2026-10458.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10458
Published
2026-07-13T17:37:53Z
Modified
2026-07-13T18:16:56.650194052Z
Summary
Malicious code in compliancepolicyserv (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8)

compliancepolicyserv@9.9.11 registers index.js as both scripts.install and main. On npm install and on require, index.js loads lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a 'paypal' prefix, a timestamp, and the domain oob.sl4x0.xyz, and issues a dns.resolve4 query against the resulting subdomain, beaconing installer identifiers over DNS to an author-controlled domain. The destination host and the names of the os/dns/process APIs and their methods (userInfo, hostname, cwd, resolve4) are reconstructed at runtime from char-code arrays in lib/b02e30.js and lib/6ad264.js, hiding the exfil endpoint and sensitive API references from static inspection. The package name resembles a compliance-policy service but the shipped code performs no such function; the sole install/import-time effect is the DNS beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-13T18:10:12.559098679Z",
            "source": "amazon-inspector",
            "modified_time": "2026-07-13T17:37:53Z",
            "sha256": "a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8",
            "id": "IN-MAL-2026-010272",
            "versions": [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / compliancepolicyserv

Package

Name
compliancepolicyserv
View open source insights on deps.dev
Purl
pkg:npm/compliancepolicyserv

Affected ranges

Affected versions

9.*
9.9.11

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/compliancepolicyserv/MAL-2026-10458.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96",
            "path": "lib/core.js"
        },
        {
            "sha256": "851793541f79bc8e02df71fc3403191758d44eb4c6fc950c6778525de23a194a",
            "path": "lib/b02e30.js",
            "tlsh": "99e068177313c94fa1880bf7b90150a0aa0d8b59a11dc0d6b928678500af443c0c0232"
        },
        {
            "sha256": "6206199bf5c6083f50598623d60159de9be8201a8e2b1b2f0d524264cb803e31",
            "path": "package.json",
            "tlsh": "80215b25ce258c232ad82990a96a6e42f4620c174d447c05b3c7a22c8fdf26f11ff66d"
        }
    ],
    "package_integrity": [
        {
            "filename": "compliancepolicyserv-9.9.11.tgz",
            "hashes": {
                "sha1": "6eba25c197269370ab1e61e41d8cc33434d68888",
                "sha512_sri": "sha512-EiegHAR1p2f8TJKwHwCxtMDi7+deqV9opYwOrr1L6ZuZhijMyVHMSJisgnaK8oKG5tV2ObWmcYsERmQngo5IWw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]