MAL-2026-11996

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/emulative/MAL-2026-11996.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11996
Published
2026-08-04T23:57:24Z
Modified
2026-08-05T00:37:51.988465045Z
Summary
Malicious code in emulative (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca)

On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T00:04:38.793800383Z",
            "sha256": "6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca",
            "id": "IN-MAL-2026-011360",
            "modified_time": "2026-08-04T23:57:24Z",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / emulative

Package

Name
emulative
View open source insights on deps.dev
Purl
pkg:npm/emulative

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-UQzS0g5PEVInL3K7C8yMuuL6zSxzk6xDHjcYTQlBAdZUhuM1VVM5sl9Yi5N8+D6AYhAVpjOdyqZCaqZUNoP+tA==",
                "sha1": "121db90604b2147ae5a5465ddb557c04da466a9a"
            },
            "filename": "emulative-1.0.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "6e411399a2da17330dd210c0660c70802359f9767169a89076cf42969f869f8b7226f3",
            "sha256": "5864e4ab40950600f1e39f253361f70207fd774aa2fe32349ed1f48ada3e1a10",
            "path": "index.js"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/emulative/MAL-2026-11996.json"