MAL-2026-10943

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aftermathfi/MAL-2026-10943.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10943
Published
2026-07-20T00:00:00Z
Modified
2026-07-28T14:37:19Z
Summary
Malicious code in aftermathfi (npm)
Details

The aftermathfi package was published to the npm registry by user 'jet0010001' (maintainer email bremagml0002@gmail.com) as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK (Aftermath Finance is a DeFi protocol on the Sui blockchain). The package was published at version 99.0.0 - an inflated version number characteristic of dependency-confusion attacks, intended to cause a misconfigured resolver to prefer this public lookalike over the intended private/internal dependency of the same name.

The package declares a preinstall hook ("node setup.js || true") that executes automatically at npm install time, before any application code runs. The bundled setup.js performs host reconnaissance and credential harvesting: it collects the machine hostname, the current OS username, the current working directory, the contents of /etc/hostname, and the output of 'git remote -v', and it enumerates process environment variables whose names match the pattern /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i - capturing API keys, secrets, tokens, passwords, and Sui/deploy/CI credentials. The collected data is serialized to JSON and exfiltrated via an HTTPS POST to the hardcoded attacker-controlled endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf, with TLS certificate verification disabled (rejectUnauthorized: false) so a self-signed listener is accepted. Errors are silently swallowed so the install appears to succeed. The published module code (index.js) is a benign stub exporting only { version: "99.0.0" }, consistent with a package built solely to deliver the install-time beacon.

The install-time payload is byte-for-byte identical across the campaign's packages (aftermath-finance, aftermath-sui, aftermathfi), all published by the same maintainer within seconds of each other and all beaconing to the same collector.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (556ad9b21010fc9541cf77cae90893323621b194137c16ea6e3bd67744366a51)

The package's preinstall script (setup.js) runs automatically during npm install and harvests installer-side data. It iterates process.env and filters keys matching credential-shaped patterns (key/secret/token/pass/auth/private/drone/gitea/sui/admin/deploy), and via execSync collects hostname, /etc/hostname, username, current working directory, and git remote -v output. The collected data is POSTed over HTTPS to the hardcoded bare-IP endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf with TLS certificate validation disabled (rejectUnauthorized:false). The destination is not a documented first-party service, and the behavior fires unconditionally on install with no opt-in.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010902",
            "import_time": "2026-07-28T14:19:58.286986024Z",
            "modified_time": "2026-07-28T13:33:53Z",
            "sha256": "556ad9b21010fc9541cf77cae90893323621b194137c16ea6e3bd67744366a51",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / aftermathfi

Package

Name
aftermathfi
View open source insights on deps.dev
Purl
pkg:npm/aftermathfi

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "729b7aaaa8b18cc377bc350faa056e25d043001ab7a86a65207b2fe676a0d808",
            "tlsh": "6b1154e093f0f3719ea595a4f04b900b5153d0077d5b7c60f69881651f8d65ca5b2ce6"
        }
    ],
    "package_integrity": [
        {
            "filename": "aftermathfi-99.0.0.tgz",
            "hashes": {
                "sha1": "a16c48837218d2ef827ca79acded21eb9e8b684a",
                "sha512_sri": "sha512-nY9gzNaxRr21MZA4fdD/ojal+2h4ase2zvbYC9gkQMl63QEZ++qr3Nju6aXlUv64PUhuBoAxbuOSOq16vgmAeQ=="
            }
        }
    ]
}
iocs 
{
    "ips": [
        "2.25.140.71"
    ],
    "urls": [
        "https://2.25.140.71:8443/aftermath/npm-dep-conf"
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aftermathfi/MAL-2026-10943.json"