MAL-2026-10726

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/astro/MAL-2026-10726.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10726
Published
2026-07-16T18:39:39Z
Modified
2026-07-16T19:19:41.768730229Z
Summary
Malicious code in astro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c)

This tarball is published as astro@7.1.0 but does not match the legitimate withastro/astro project (which is on the v5.x line and depends on picocolors, debug, and @astrojs/markdown-remark). The package.json declares dependencies on typosquat-shaped names on the same registry: piccolore, obug, and @astrojs/markdown-satteri. Core modules import these look-alikes unconditionally — dist/core/logger/node.js contains import { createDebug, enable as obugEnable } from "obug" and dist/cli/infra/piccolore-text-styler.js contains import colors from "piccolore" — so any require('astro') or CLI invocation causes those attacker-controlled packages to be resolved and executed inside the installer's node_modules tree. The version jump from the real 5.x line and the substitution of the standard utility dependencies with lookalike names indicate a registry impersonation of the astro framework, structured as a dependency-chain dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-16T18:54:01.867712013Z",
            "modified_time": "2026-07-16T18:39:39Z",
            "sha256": "949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c",
            "versions": [
                "7.1.0"
            ],
            "id": "IN-MAL-2026-010735",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / astro

Package

Name
astro
View open source insights on deps.dev
Purl
pkg:npm/astro

Affected ranges

Affected versions

7.*
7.1.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "74f1fd15cde98c6329840ea9b8760182b236c2474d40fa0d379916bd5f8d7df21fbb6e",
            "sha256": "8ade6533a2b7e6ee93a7cce04d3f3b56bdc3a97abf4cf1c3f247b66ef6f24773",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "astro-7.1.0.tgz",
            "hashes": {
                "sha1": "0646a4d822d4d3a157b58b4abb22f75316dda3ba",
                "sha512_sri": "sha512-jXHNZXpO0HOuANLwv5uLg5WFXFmIMyDTMlokIb8sv10y8QItOFaikwrqvp6+Pe0MSqvp+aO7V1SfVriFcCEKgA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/astro/MAL-2026-10726.json"