MAL-2026-11108

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/string-format-kit/MAL-2026-11108.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11108
Published
2026-07-28T06:27:41Z
Modified
2026-08-05T10:06:28.153335343Z
Summary
Malicious code in string-format-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa)

The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads ~/.ssh/idrsa, ~/.ssh/authorizedkeys, ~/.ssh/knownhosts, ~/.aws/credentials, ~/.bash_history, the full process environment, and host reconnaissance output (whoami, hostname, id, sudo -ln, uname, /etc/os-release, /proc/1/cgroup, /.dockerenv, ps aux, ip addr, ls -la /), base64-encodes the aggregate, and transmits it via curl over plain HTTP to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/d. The declared package purpose (string formatting) has no legitimate need to read the installer's SSH private keys or cloud credentials. The name resembles legitimate string-formatting libraries, consistent with typosquatting to lure installations.

Source: ossf-package-analysis (752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb)

The OpenSSF Package Analysis project identified 'string-format-kit' @ 1.0.2 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "sha256": "752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-07-28T07:26:58.183931288Z",
            "modified_time": "2026-07-28T06:27:41Z"
        },
        {
            "sha256": "d4ab7165e6602c9334efccd6113ccdd4edc62279e23d6a3cc8eb2f909e57a2ae",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-08-04T21:33:14.973223296Z",
            "id": "IN-MAL-2026-011046",
            "modified_time": "2026-08-04T21:24:42Z"
        },
        {
            "sha256": "9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ],
            "import_time": "2026-08-05T09:28:10.735986751Z",
            "id": "IN-MAL-2026-014435",
            "modified_time": "2026-08-05T08:50:01Z"
        }
    ]
}
References
Credits

Affected packages

npm / string-format-kit

Package

Name
string-format-kit
View open source insights on deps.dev
Purl
pkg:npm/string-format-kit

Affected ranges

Affected versions

1.*
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/string-format-kit/MAL-2026-11108.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "cd9315d4631bfde5bfe82042b45105c9f42839f41b7b39261e4358957a5f9f3a",
            "tlsh": "195112fcb93578333f1e8a94f3ad6a0a8593dc9f4bf4eb0054b61d280c0cd413665a66",
            "path": "postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "string-format-kit-1.0.2.tgz",
            "hashes": {
                "sha1": "82b3fdf6d3ee3b04c3d43c18118eebba1ff52023",
                "sha512_sri": "sha512-7cimO9IBlhN1yhYRC7ZJvoQ5sgecMODdrtnrIuSe3jsqZ3cFUkyTkQxZAWIcMwmdWsXzY21nhA6/Uv6aBmcb7Q=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]