MAL-2026-11151

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/text-line-parser/MAL-2026-11151.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11151
Published
2026-07-28T13:37:07Z
Modified
2026-07-28T14:37:26.023453681Z
Summary
Malicious code in text-line-parser (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749)

The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs (hexToRgb/rgbToHsl). On npm install, postinstall.js executes a shell pipeline that collects hostname, user, cwd, uname, /proc/1/cgroup, /.dockerenv, the process tree, local IP addresses, /etc/resolv.conf nameservers, and probes Tencent Cloud and AWS IMDS cloud-metadata endpoints. It then dumps the full process environment (filtering only npm_* noise, so CI tokens, cloud credentials, and API keys are captured) together with GitHub Actions identifiers (GITHUBREPOSITORY, GITHUBACTOR, GITHUBRUNID, CI, RUNNER_NAME), base64-encodes the payload, and sends it via HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The declared package purpose does not require any of this behavior; the mismatch between the advertised text-parsing role and the shipped reconnaissance/exfiltration code is consistent with a typosquat/decoy supply-chain attack.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749",
            "import_time": "2026-07-28T14:19:59.315885441Z",
            "modified_time": "2026-07-28T13:37:07Z",
            "id": "IN-MAL-2026-010924",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / text-line-parser

Package

Name
text-line-parser
View open source insights on deps.dev
Purl
pkg:npm/text-line-parser

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/text-line-parser/MAL-2026-11151.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9",
            "path": "postinstall.js",
            "tlsh": "8931fbf8b56ded72304dc5f8b75d14053846eaeb58e4ff74281b8875008e48420a9136"
        },
        {
            "sha256": "22f7e7e084e30d9bda67d14a20714386c8ca4f3a10dbb922026ad7696b1e7fab",
            "path": "package.json",
            "tlsh": "68d05e105e229773b9c09bba2e176206b6610e5b1204fc2c67a75558878f27644ff219"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "24d124610638206c28470bb03ddedf015bbed0f8",
                "sha512_sri": "sha512-e0bB283o8J1HtIWVEm9o9exu6pE3DOUluNV0zL0quiaWDsZuCNA9/Ex9mmc5442qCZiMXa9noo35F/gZhRuvUA=="
            },
            "filename": "text-line-parser-1.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]