MAL-2026-10712

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hibachi-xyz/common/MAL-2026-10712.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10712
Published
2026-07-16T18:35:03Z
Modified
2026-07-16T19:19:56.371322099Z
Summary
Malicious code in @hibachi-xyz/common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5)

On require(), index.js enumerates process.env and filters keys matching credential-shaped patterns (KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE, GITHUB, DB, RDS, SENTRY, PYPI, NPM, DOCKER, KUBE, TUNNEL, CF_), collects os.hostname() and os.userInfo().username, and runs execSync("whoami && id && cat /proc/1/cgroup...") for container/CI fingerprinting. The combined JSON payload is POSTed to https://jorijo.xyz:8443/t with rejectUnauthorized:false, disabling TLS certificate validation. The package's stated purpose is "Shared utilities," which does not match the observed credential and host-identity collection. Any process that imports this package leaks environment secrets and host identity to the hardcoded endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010705",
            "versions": [
                "99.0.0"
            ],
            "modified_time": "2026-07-16T18:35:03Z",
            "sha256": "29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5",
            "import_time": "2026-07-16T18:54:00.214961005Z"
        }
    ]
}
References
Credits

Affected packages

npm / @hibachi-xyz/common

Package

Name
@hibachi-xyz/common
View open source insights on deps.dev
Purl
pkg:npm/%40hibachi-xyz/common

Affected ranges

Affected versions

99.*
99.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hibachi-xyz/common/MAL-2026-10712.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "2111e3e0c7e591b452b2a2e494efc017b2e3cc207156ede0368d5ba23e92d9404771f3",
            "path": "index.js",
            "sha256": "0d800f2db51cc9935282ab475e18151d9f169c6b40d5af666b6f405ab9b1fa5e"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-V0VSun9YZ7IqSEUISkoTfEzAVWslGD57feZMbROR7Kjxy13Dn/mXfLJqQC1V7pcmxG5Tgyl06/15RHbNL/FetQ==",
                "sha1": "feb179f886c3d3c1caae1283286b180cb04b9d63"
            },
            "filename": "common-99.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]