MAL-2026-10717

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@onescience/onecode/MAL-2026-10717.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10717
Published
2026-07-16T18:41:22Z
Modified
2026-07-16T19:19:57.789198056Z
Summary
Malicious code in @onescience/onecode (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d334dd52244b44793af06be86dfd8d0de20ea8bb6d28cc1e4016b5fa45432578)

The postinstall lifecycle script runs ensurePlatformBinary, which when the optionalDependency install fails to populate the platform package falls back to fetching a.tgz over HTTPS from a hardcoded bare-IP endpoint, https://218.90.133.98:4443/onecode_tgz/, with rejectUnauthorized:false disabling TLS certificate verification. The fetched archive is extracted with tar, the extracted binary is chmod 0755 and hardlinked into bin/.onecode, and that binary becomes the CLI invoked as onecode. No hash or signature verification is performed, the host is a bare IP rather than a publisher-owned domain, and the URL always constructs onecode-linux-x64-<version>.tgz regardless of the detected platform/arch. Whoever controls the endpoint at 218.90.133.98:4443 — or any on-path attacker, given TLS verification is disabled — can deliver arbitrary executable content to any installer whose optional platform dependency fails to install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-16T18:54:02.40266225Z",
            "source": "amazon-inspector",
            "sha256": "5928c2edb03c7fc9a909b2ff56355dde83cab5e7776512204a35e274120932f5",
            "versions": [
                "1.14.50-202607161038"
            ],
            "id": "IN-MAL-2026-010746",
            "modified_time": "2026-07-16T18:41:22Z"
        },
        {
            "import_time": "2026-07-16T18:54:03.515113628Z",
            "modified_time": "2026-07-16T18:44:15Z",
            "sha256": "d334dd52244b44793af06be86dfd8d0de20ea8bb6d28cc1e4016b5fa45432578",
            "versions": [
                "1.14.50-202607161710"
            ],
            "id": "IN-MAL-2026-010765",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-07-16T18:54:03.76950404Z",
            "modified_time": "2026-07-16T18:44:51Z",
            "sha256": "fa28860ddf0274e1a39af78373aa118824c4479ef158d166d230de533a1b34d0",
            "versions": [
                "1.14.50-202607161139"
            ],
            "id": "IN-MAL-2026-010769",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @onescience/onecode

Package

Name
@onescience/onecode
View open source insights on deps.dev
Purl
pkg:npm/%40onescience/onecode

Affected ranges

Affected versions

1.*
1.14.50-202607161038
1.14.50-202607161139
1.14.50-202607161710

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "ad02448657f143b08ba166ea225b7514a63991123e0fad9cfadc47d43b61128e3837fc",
            "sha256": "0795feaceb78b42d123dafb190444f534ea5e51c920775aaafe3ee2cee0acf47",
            "path": "platform-bootstrap.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "onecode-1.14.50-202607161038.tgz",
            "hashes": {
                "sha1": "207b6685273c80f29e0bccca3875606db194ecb7",
                "sha512_sri": "sha512-9SEdFnEwYTTvxyrmzYfxkd/eRKR4N/I1wZQfF+5ML0Sp8Q8IG3WyUVvhQEnYFu/wlESEbWAqOza9CexzYpCQzg=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@onescience/onecode/MAL-2026-10717.json"