MAL-2026-12039

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/data-format-helper/MAL-2026-12039.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12039
Published
2026-08-05T01:02:58Z
Modified
2026-08-05T01:49:49.562138500Z
Summary
Malicious code in data-format-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd)

The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to collect installer/CI identity and secrets, then sends them to an attacker-controlled Burp Collaborator subdomain over plain HTTP. Observed collection includes hostname, whoami/id, sudo -l output, process and network state, GitHub Actions environment (GITHUBTOKEN, GITHUBREPOSITORY, GITHUBACTOR, RUNID and related), and any environment variables matching KEY|TOKEN|SECRET|NPMTOKEN|AWS|AZURE|GCP|GITHUB_TOKEN, each base64-encoded and sent via curl to http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/. The script additionally probes cloud instance-metadata endpoints for AWS, Aliyun, GCP and Tencent and forwards the responses to the same collector. A separate phase probes the internal hostname tst.woa.com and base64-encodes the response body of an internal flag.html before sending it to the collector, indicating targeted reconnaissance against a specific internal (Tencent) environment consistent with a dependency-confusion decoy. The advertised 'data formatting utilities' description and benign color-helper index.js are cover metadata unrelated to the postinstall behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-011483",
            "import_time": "2026-08-05T01:39:30.97120653Z",
            "sha256": "1f06ab5181c32dbe125d9dfe5b9c8f9e4052a060b61acdc04afc886b1a097fa9",
            "modified_time": "2026-08-05T01:03:23Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-011482",
            "import_time": "2026-08-05T01:39:30.924102224Z",
            "sha256": "21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd",
            "modified_time": "2026-08-05T01:02:58Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / data-format-helper

Package

Name
data-format-helper
View open source insights on deps.dev
Purl
pkg:npm/data-format-helper

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-8prHNGGQerlM5lxvufGE9KFIPp7KjlWo9vCrf/OE3mNG2T5ECXhW91dOJZLpVgWLetdjIWCcDFwzMMNJE/GpQw==",
                "sha1": "4a27eae56bc43f9a4b0342813985c34f2869ddc2"
            },
            "filename": "data-format-helper-1.0.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84",
            "tlsh": "cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77"
        },
        {
            "path": "package.json",
            "sha256": "a89ccac7d9afddaef91c32acdf10398f48838f4500c21b4e665dfbf9e06aaac2",
            "tlsh": "56e02b10d9218633a9c45ba69da3424b7e311e1e1310bc6d27d7705c838fafa85bf31e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/data-format-helper/MAL-2026-12039.json"