MAL-2026-10894

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-checkout/MAL-2026-10894.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10894
Aliases
  • GHSA-mqx8-fhj5-w597
Published
2026-07-20T10:42:41Z
Modified
2026-09-01T11:30:36Z
Summary
Malicious code in exodus-checkout (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b10e41b9a87dc4927d3c4bc63b25bc1fa438cfae1bcf5f1d483204a18d5765f6)

Package exodus-checkout self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It mimics the internal API surface (generateMnemonicSigningKeys, signCharge, signRefund, signCancelSubscription in src/index.js), but every exported function throws — there is no functional implementation. On npm install, src/canary.js runs a postinstall hook that performs a DNS lookup and HTTPS GET to a hardcoded serveo SSH-tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install), passing the package's own name and version as query parameters. No installer data (env vars, filesystem, credentials) is read or transmitted — the beacon carries only the package's own identity. Installer-side impact: any build that resolves exodus-checkout from public npm (whether by typo, dependency confusion, or accidental inclusion) breaks at runtime because all exports throw, and emits a one-way network signal to a researcher-controlled tunnel domain that is not Exodus infrastructure and cannot be audited by Exodus or the installer. Routing to human review: name-impersonation of a vendor's internal namespace plus an install-time outbound beacon is the dependency-confusion shape, but the absence of any data exfiltration or remote-code-execution mechanism keeps this below the active-attack threshold.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05534",
            "import_time": "2026-07-20T13:14:46.088305809Z",
            "modified_time": "2026-07-20T10:42:41Z",
            "sha256": "7675bbf85d1c6736952eca830341836db29b378fbda4a9466645f2ca28a0ac6c",
            "source": "reversing-labs",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "IN-MAL-2026-012911",
            "import_time": "2026-08-05T06:00:18.969147625Z",
            "modified_time": "2026-08-05T05:06:51Z",
            "sha256": "b10e41b9a87dc4927d3c4bc63b25bc1fa438cfae1bcf5f1d483204a18d5765f6",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "RLUA-2026-06228",
            "import_time": "2026-09-01T11:18:05.239135089Z",
            "modified_time": "2026-08-24T16:50:58Z",
            "sha256": "6711b73c156f43b51ac8272c2a4aec48ffc535e413f443a5f8777d6c9260d6ec",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / exodus-checkout

Package

Name
exodus-checkout
View open source insights on deps.dev
Purl
pkg:npm/exodus-checkout

Affected ranges

Affected versions

99.*
99.0.0-canary.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "8df05b04ab1173592b08d71dea34f5998519f445526493f61ab3dd9dc0145a5a",
            "tlsh": "63e07d5f0961337a1d8bd441d49794213fa2560ad0fd89a60c8d521f75035348eff0c5"
        },
        {
            "path": "src/canary.js",
            "sha256": "16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51",
            "tlsh": "37e06ffe4fd0a33a56701bc9f080a54fe707e3283085a2c1d69822a249c28f0ae218f0"
        },
        {
            "path": "README.md",
            "sha256": "cacfc22dac62ab18a95edb6dff59d47e191b0b0dc4dc5365bf18782da02f5ac6",
            "tlsh": "e8e0c04495e1032256f56cf966d709d06b7cf07061169da9bfcb560f6308a9ac30368e"
        }
    ],
    "package_integrity": [
        {
            "filename": "exodus-checkout-99.0.0-canary.1.tgz",
            "hashes": {
                "sha1": "95da3c4d9d5bd33667fdc643618bfc92f4b2dd01",
                "sha512_sri": "sha512-sNpAjNExfERmXr5vgaTMV3Y2AllVKWv0CTOZ+HEIXV/OEkrTDfCEhSaVM9Q5SxSx2z7H4r2zY2AssMZYTcL5+w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-checkout/MAL-2026-10894.json"