MAL-2026-11134

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/color-convert-helper/MAL-2026-11134.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11134
Published
2026-07-28T13:42:20Z
Modified
2026-07-28T14:36:52Z
Summary
Malicious code in color-convert-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9)

The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity (hostname, whoami, id, sudo -l, uname), CI/GitHub Actions environment variables, network interface information, running processes, and environment variables filtered by KEY/TOKEN/SECRET/CREDENTIAL/NPM/AZURE/GCP/CLOUD, then queries cloud instance-metadata endpoints (AWS/Aliyun/GCP/Tencent at 169.254.169.254) to fetch IAM security credentials. The collected data is base64-encoded and curled to the hardcoded attacker-controlled OAST domain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The script also performs DNS and HTTP probes against the internal hostname tst.woa.com and issues an SSRF forwarder request, reporting resolvability back to the same OAST domain. The advertised purpose of the package is color conversion; the actual behavior is credential and cloud-IAM harvesting plus internal-perimeter reconnaissance from every install host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010961",
            "import_time": "2026-07-28T14:20:01.545783986Z",
            "modified_time": "2026-07-28T13:42:20Z",
            "sha256": "9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / color-convert-helper

Package

Name
color-convert-helper
View open source insights on deps.dev
Purl
pkg:npm/color-convert-helper

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "848c862e482bcebb18294fe6a8eede4fa38b47a71cbdc2eeb5555420870b128b",
            "tlsh": "53b1f1e8b629e8313659c0b4f69e95013497f8df4af4ff3445274db4058c7c921baa72"
        }
    ],
    "package_integrity": [
        {
            "filename": "color-convert-helper-1.0.0.tgz",
            "hashes": {
                "sha1": "01628878684759b7a5b53fa1428aada1d84b1fa1",
                "sha512_sri": "sha512-+YlXQ1g0qo9dmn/hFSF8JdJwZztJLJrQZqWWJZSw4Ri4yAFFiySWZ9g7/7EU6cTgLNer7SyqzYvbHaEdxT+HOQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/color-convert-helper/MAL-2026-11134.json"