MAL-2026-11427

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pp-react-worldready/MAL-2026-11427.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11427
Published
2026-08-01T13:40:50Z
Modified
2026-08-04T22:05:13Z
Summary
Malicious code in pp-react-worldready (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7)

package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads os.hostname() and CI/GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends them as query parameters to a hardcoded webhook.site collector at https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also performs a DNS lookup embedding the hostname as a subdomain of your-collab-domain.oastify.com (Burp Collaborator) as an out-of-band exfiltration channel. This is the canonical dependency-confusion reconnaissance beacon shape: identify internal build hosts that mistakenly resolve the package name from the public registry.

Source: ossf-package-analysis (6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5)

The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-01T14:36:09.526427578Z",
            "modified_time": "2026-08-01T13:40:50Z",
            "sha256": "6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-011097",
            "import_time": "2026-08-04T21:33:16.646898555Z",
            "modified_time": "2026-08-04T21:32:02Z",
            "sha256": "6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / pp-react-worldready

Package

Name
pp-react-worldready
View open source insights on deps.dev
Purl
pkg:npm/pp-react-worldready

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "vishu.js",
            "sha256": "2ce5acaf6ac8cd77b4bc4a8329d6f39831cc2e2ed739a0bd1a9284789ba7aa1f",
            "tlsh": "bd313e4ca2f7962004f263c8162b941e605be1933729ce917a9c02521faad3882e3bd8"
        }
    ],
    "package_integrity": [
        {
            "filename": "pp-react-worldready-1.0.0.tgz",
            "hashes": {
                "sha1": "f20d7532e1d0c5ca8b24f73f14caf95ca376bdc3",
                "sha512_sri": "sha512-D/7r5IGpmp3gfzAaAwFI084z10NSrN76lnsK9vFj7ywR//viiHoaA+Ni2WMpJuPPQuJtJzO+YLnpHou44KjJeg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pp-react-worldready/MAL-2026-11427.json"