MAL-2026-11152

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tidal-embed-player/MAL-2026-11152.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11152

Aliases

GHSA-7w7p-cq73-h3p4

Published

2026-07-28T13:32:44Z

Modified

2026-09-09T03:30:13Z

Summary

Malicious code in tidal-embed-player (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers (os.hostname(), os.userInfo().username, homedir, DNS servers, cwd), reads the package.json, and reads /etc/passwd and /etc/hosts from the installer host, then POSTs the combined payload over HTTPS to 1rtlwocct2ruj1kc2njqbw96wx2qqhe6.oastify.com — a Burp Collaborator subdomain used to receive out-of-band callbacks. The package name suggests a Tidal media embed player but the shipped code performs only host reconnaissance and exfiltration, with no player functionality.

Source: ghsa-malware (2431f85c58e75a787b5d6ee7f9bc2d2c86401aed86c9ce42605bcd2387124ca7)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010893",
            "import_time": "2026-07-28T14:19:57.861861276Z",
            "modified_time": "2026-07-28T13:32:44Z",
            "sha256": "005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "GHSA-7w7p-cq73-h3p4",
            "import_time": "2026-09-08T00:15:10.611123876Z",
            "modified_time": "2026-09-07T16:17:49Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "2431f85c58e75a787b5d6ee7f9bc2d2c86401aed86c9ce42605bcd2387124ca7",
            "source": "ghsa-malware"
        },
        {
            "id": "IN-MAL-2026-019789",
            "import_time": "2026-09-09T03:21:53.782817231Z",
            "modified_time": "2026-09-09T02:46:09Z",
            "sha256": "34e97d9331ef54b08dcc7adff8e75ca0390a5cb3964c1c9f03f5a7c5d7d85235",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / tidal-embed-player

Package

Name: tidal-embed-player; View open source insights on deps.dev
Purl: pkg:npm/tidal-embed-player

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.1

1.0.2

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "c16c3da7e51cb852420573b120676e71b8f30bec3b4c57d06fdf24c731a15374",
            "tlsh": "7d41259562d917330dd110c06a0c70813359fa777259d89076cf42d6af869f8b7326f3"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tidal-embed-player/MAL-2026-11152.json"