MAL-2026-11152

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tidal-embed-player/MAL-2026-11152.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11152
Published
2026-07-28T13:32:44Z
Modified
2026-07-28T14:37:26.656225593Z
Summary
Malicious code in tidal-embed-player (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers (os.hostname(), os.userInfo().username, homedir, DNS servers, cwd), reads the package.json, and reads /etc/passwd and /etc/hosts from the installer host, then POSTs the combined payload over HTTPS to 1rtlwocct2ruj1kc2njqbw96wx2qqhe6.oastify.com — a Burp Collaborator subdomain used to receive out-of-band callbacks. The package name suggests a Tidal media embed player but the shipped code performs only host reconnaissance and exfiltration, with no player functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-28T13:32:44Z",
            "source": "amazon-inspector",
            "sha256": "005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5",
            "import_time": "2026-07-28T14:19:57.861861276Z",
            "id": "IN-MAL-2026-010893",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tidal-embed-player

Package

Name
tidal-embed-player
View open source insights on deps.dev
Purl
pkg:npm/tidal-embed-player

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "7d41259562d917330dd110c06a0c70813359fa777259d89076cf42d6af869f8b7326f3",
            "sha256": "c16c3da7e51cb852420573b120676e71b8f30bec3b4c57d06fdf24c731a15374",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tidal-embed-player/MAL-2026-11152.json"