MAL-2026-12136

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-stores/MAL-2026-12136.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12136
Published
2026-08-05T09:08:53Z
Modified
2026-08-05T10:05:46Z
Summary
Malicious code in accounts-stores (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d)

The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a try/catch. setup.js schedules a next-tick bootstrap that collects a host fingerprint (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch), derives an installId, and loads a ~76KB lib/telemetry.js runtime that POSTs data via https.request. The identifier reads are obfuscated via string-concatenation indirection (os"host"+"name", os"user"+"Info", os"plat"+"form", and a helper const _p=(k)=>osk), which is not consistent with legitimate telemetry SDKs. The destination host is not present as a plain literal in telemetry.js; the file imports dns and https and contains a ServiceDiscovery class that resolves the endpoint at runtime, hiding the exfiltration target from source inspection. Nothing in the advertised state-store API references telemetry, and no opt-in or configuration surface is exposed.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-014565",
            "import_time":  "2026-08-05T09:28:26.114996744Z",
            "modified_time":  "2026-08-05T09:08:53Z",
            "sha256":  "c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / accounts-stores

Package

Name
accounts-stores
View open source insights on deps.dev
Purl
pkg:npm/accounts-stores

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "48a5b511b15cae43853d652f9c988e50d654ff2cbe1476011064098d7a642906",
            "tlsh":  "9b01475237aa696f8474a3a39e3d4167f88bc43505801298b38881dc1fa8c14449dcbc"
        },
        {
            "path":  "setup.js",
            "sha256":  "56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6",
            "tlsh":  "1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f"
        },
        {
            "path":  "lib/telemetry.js",
            "sha256":  "eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553",
            "tlsh":  "6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "accounts-stores-0.0.1.tgz",
            "hashes":  {
                "sha1":  "dba11c804cf2e65380631db3f2dc60a390d1ec51",
                "sha512_sri":  "sha512-7jdabfKv77/KnuqQAQt43UHzKUgGzHGAc3hpELZgk6FjaGHpj9xzn9wP6s6JG09dYSoDp5R1oQHhq32BEinI9w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-stores/MAL-2026-12136.json"