MAL-2026-10748

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/string-formatter-pro/MAL-2026-10748.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10748
Published
2026-07-16T18:33:06Z
Modified
2026-07-16T19:19:59.456170246Z
Summary
Malicious code in string-formatter-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (966ebbfb039acea9e1f98c5f74f13e2aab1617e371719bc9543315702dbd67cd)

The package advertises itself as a string-formatting utility whose main module exports only a trivial one-line capitalize() function, but ships a postinstall.js lifecycle script that runs automatically on npm install. postinstall.js issues a chain of curl commands against cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254, Alibaba at 100.100.100.200, Tencent at metadata.tencentyun.com, and 169.254.0.23) to harvest IAM security credentials, EC2 user-data, the instance identity document, and the host's OpenSSH public key, then POSTs the aggregated output plus a directory listing of /data/ to the hardcoded destination pwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com (a Burp Collaborator subdomain). The trivial library surface is a decoy for install-time credential theft against the installer's cloud environment.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.1"
            ],
            "sha256": "966ebbfb039acea9e1f98c5f74f13e2aab1617e371719bc9543315702dbd67cd",
            "import_time": "2026-07-16T18:53:59.411754232Z",
            "modified_time": "2026-07-16T18:33:06Z",
            "id": "IN-MAL-2026-010692",
            "source": "amazon-inspector"
        },
        {
            "modified_time": "2026-07-16T18:37:49Z",
            "sha256": "dcc99e6af3349c947820bca0200bd761575b5fb45b03eb35e465b6bd9697976c",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-07-16T18:54:01.184925807Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010722"
        }
    ]
}
References
Credits

Affected packages

npm / string-formatter-pro

Package

Name
string-formatter-pro
View open source insights on deps.dev
Purl
pkg:npm/string-formatter-pro

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "string-formatter-pro-1.0.1.tgz",
            "hashes": {
                "sha1": "03bf9a55d075681a7191b2490e5337cfca8626c9",
                "sha512_sri": "sha512-7XMCu8dWmhgYlfCmTswGMENrYTXcDAten4BCNKe4cq03zHUVXNL++/MdH5pjXQ2zNd3JtnuWpGL37WeQaaWROg=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "b141f298f6997c3a9d17cfb9e356120fa53068851ec0bb1784f02cf49d09a5ab329f81",
            "sha256": "224a7549abd6399fdfa0e4e178f60e64d16e3e55434241134c4e05003781a7e8",
            "path": "postinstall.js"
        },
        {
            "tlsh": "55a0240140d5304f014c51157f17114704c5c74011c000f403dc150c00114f001d1fcc",
            "sha256": "730c27aa8c390ed070f352f3f92be56cda4055318c1ddb1510c0cfb09bad6866",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/string-formatter-pro/MAL-2026-10748.json"