MAL-2026-11066

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ks-radar/radar/MAL-2026-11066.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11066
Published
2026-07-25T21:45:33Z
Modified
2026-08-05T14:34:59.044884740Z
Summary
Malicious code in @ks-radar/radar (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce)

On npm install, the package's preinstall lifecycle script (preinstall.js) reads a hex-encoded command string from preinstall.json, decodes it via Buffer.from(hexCommand, 'hex'), and passes the decoded string to child_process.exec. The decoded command invokes curl against https://eobdzec83knbura.m.pipedream.net and POSTs installer-side reconnaissance data including the output of whoami, the current working directory, the hostname, and the contents of /etc/passwd and /etc/hosts. The hex encoding of the command serves no legitimate build purpose and hides the exfiltration target and payload from casual inspection of package.json. The destination pipedream.net endpoint is an attacker-controlled request-collection URL, unrelated to any documented publisher infrastructure.

Source: ossf-package-analysis (24bbd0f16f929682cd413abde1e40578db9fa5b2ad8cb7cdc9927c70f5f5f710)

The OpenSSF Package Analysis project identified '@ks-radar/radar' @ 22.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "24bbd0f16f929682cd413abde1e40578db9fa5b2ad8cb7cdc9927c70f5f5f710",
            "versions": [
                "22.0.0"
            ],
            "source": "ossf-package-analysis",
            "import_time": "2026-07-25T21:51:07.872367955Z",
            "modified_time": "2026-07-25T21:45:33Z"
        },
        {
            "modified_time": "2026-08-04T21:20:29Z",
            "sha256": "4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce",
            "versions": [
                "22.0.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011018",
            "import_time": "2026-08-04T21:33:13.85466595Z"
        },
        {
            "sha256": "fc1180617635fc93756fd54302446cc65e49e448edcc00ef376b50778698f570",
            "source": "amazon-inspector",
            "versions": [
                "21.0.0"
            ],
            "modified_time": "2026-08-05T12:51:13Z",
            "id": "IN-MAL-2026-014787",
            "import_time": "2026-08-05T13:08:46.493346603Z"
        },
        {
            "sha256": "c850d96784a792766b5cf998394996197239a96c90116d62061aa0b19cf5cb87",
            "source": "amazon-inspector",
            "versions": [
                "20.0.0"
            ],
            "modified_time": "2026-08-05T13:12:49Z",
            "id": "IN-MAL-2026-014927",
            "import_time": "2026-08-05T14:19:43.758680409Z"
        }
    ]
}
References
Credits

Affected packages

npm / @ks-radar/radar

Package

Name
@ks-radar/radar
View open source insights on deps.dev
Purl
pkg:npm/%40ks-radar/radar

Affected ranges

Affected versions

20.*
20.0.0
21.*
21.0.0
22.*
22.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ks-radar/radar/MAL-2026-11066.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "b97ce8848ce6de5aa0f5e21cc100ba19e48cd2cb4d57dd85015c2f1797285b87",
            "tlsh": "4ff07d052dfa1237403b20a54a47580b318ad901313adda2bbae5b516fc5c64cca36c9"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "01c596ae0a0593e54f695580d584a39871077562",
                "sha512_sri": "sha512-iOqhE5DrgkUCf8C+WQASq+wGmjZKdjLmD0DAMG7O6jL20DaTU4P0amyXuW5Vtzq0GRrKil9YGe9bwP0ocsUCLg=="
            },
            "filename": "radar-22.0.0.tgz"
        }
    ]
}