MAL-2026-10895

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-payments/MAL-2026-10895.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10895
Aliases
  • GHSA-hrvv-3w2f-pp24
Published
2026-07-20T10:42:42Z
Modified
2026-09-01T11:31:19Z
Summary
Malicious code in exodus-payments (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e)

Package is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook (src/canary.js) performs a DNS lookup and HTTPS GET to a hardcoded Serveo tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com), sending only the package's own name and version as query parameters. No environment variables, credentials, filesystem contents, or other installer data are read or transmitted; the only signal the operator gains is the installer's public egress IP from the inbound request metadata. README discloses the canary purpose. Concerns: install-time outbound network without opt-out (breaks air-gapped/sandboxed CI), destination is a third-party mutable tunneling endpoint rather than publisher-owned infrastructure, and the canary version coordinate (99.0.0-canary.1) is shaped to win dependency-confusion races against private packages. No credential theft, no code execution of remote content, no persistence.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05535",
            "import_time": "2026-07-20T13:14:46.17221799Z",
            "modified_time": "2026-07-20T10:42:42Z",
            "sha256": "328b16bdcd1792de22d87fbbe353e2fc58968a0c1f64f46eddd29da089df2495",
            "source": "reversing-labs",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "IN-MAL-2026-012910",
            "import_time": "2026-08-05T06:00:18.869471273Z",
            "modified_time": "2026-08-05T05:06:43Z",
            "sha256": "51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "RLUA-2026-06229",
            "import_time": "2026-09-01T11:18:05.674058156Z",
            "modified_time": "2026-08-24T16:50:58Z",
            "sha256": "16663a5c8890c81d50b74bc27316c674904d9a157afe9ba82e1c579024624d06",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / exodus-payments

Package

Name
exodus-payments
View open source insights on deps.dev
Purl
pkg:npm/exodus-payments

Affected ranges

Affected versions

99.*
99.0.0-canary.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/canary.js",
            "sha256": "16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51",
            "tlsh": "37e06ffe4fd0a33a56701bc9f080a54fe707e3283085a2c1d69822a249c28f0ae218f0"
        }
    ],
    "package_integrity": [
        {
            "filename": "exodus-payments-99.0.0-canary.1.tgz",
            "hashes": {
                "sha1": "ef1889f61bed28df187b2967497ecdf8afe04463",
                "sha512_sri": "sha512-SlHTjiBKt3pWq5iSy2JO/SjNK83FfqARXq9gFRveex+ltnNAreNWjmKIqGLwiyfMUTQr3vXbuO1vlliI3MFR0w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-payments/MAL-2026-10895.json"