MAL-2026-11147

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-probe-utils/MAL-2026-11147.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11147
Published
2026-07-28T13:43:24Z
Modified
2026-07-28T14:37:11.338475429Z
Summary
Malicious code in simple-probe-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c)

On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.169.254, plus Tencent, Aliyun, GCP, and Azure endpoints) and extracts the AWS IAM role's temporary security credentials. The captured IAM credentials, hostname, and username are appended as query parameters to an HTTP request to the hardcoded out-of-band host pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (a Burp Collaborator-style domain). The package.json describes the module as a lightweight string formatting helper; the shipped code contains only the credential-harvesting postinstall, with no string-utility functionality present.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-28T14:20:01.920115596Z",
            "sha256": "0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c",
            "modified_time": "2026-07-28T13:43:24Z",
            "id": "IN-MAL-2026-010969",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / simple-probe-utils

Package

Name
simple-probe-utils
View open source insights on deps.dev
Purl
pkg:npm/simple-probe-utils

Affected ranges

Affected versions

1.*
1.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simple-probe-utils/MAL-2026-11147.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "cd9315d4631bfde5bfe82042b45105c9f42839f41b7b39261e4358957a5f9f3a",
            "tlsh": "195112fcb93578333f1e8a94f3ad6a0a8593dc9f4bf4eb0054b61d280c0cd413665a66",
            "path": "postinstall.js"
        },
        {
            "sha256": "962c4890dffe3a9c143612c5666dcf43a18e0ce8f7a63e9ef0eae3cfa41f2476",
            "tlsh": "1de07d0c8d0256331ed44b117dfb854ab9754e064248786c57db440c43ce6fa94fbb1c",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "simple-probe-utils-1.0.1.tgz",
            "hashes": {
                "sha1": "472752aa7fb1f398816a76e537bf686e961e1138",
                "sha512_sri": "sha512-IYed3Os65KqsGWYQMUzETp+mJFT+fZ+i+/CB16ooN9FJuo8iebfZQDKVYy9s2rKH8DMdY5RqOAXmbdDAlF614g=="
            }
        }
    ]
}