MAL-2026-11996

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/emulative/MAL-2026-11996.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11996
Published
2026-08-04T23:57:24Z
Modified
2026-08-05T00:37:51Z
Summary
Malicious code in emulative (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca)

On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-011360",
            "import_time":  "2026-08-05T00:04:38.793800383Z",
            "modified_time":  "2026-08-04T23:57:24Z",
            "sha256":  "6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / emulative

Package

Name
emulative
View open source insights on deps.dev
Purl
pkg:npm/emulative

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "5864e4ab40950600f1e39f253361f70207fd774aa2fe32349ed1f48ada3e1a10",
            "tlsh":  "6e411399a2da17330dd210c0660c70802359f9767169a89076cf42969f869f8b7226f3"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "emulative-1.0.1.tgz",
            "hashes":  {
                "sha1":  "121db90604b2147ae5a5465ddb557c04da466a9a",
                "sha512_sri":  "sha512-UQzS0g5PEVInL3K7C8yMuuL6zSxzk6xDHjcYTQlBAdZUhuM1VVM5sl9Yi5N8+D6AYhAVpjOdyqZCaqZUNoP+tA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/emulative/MAL-2026-11996.json"