MAL-2026-12180

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/geocode-quick/MAL-2026-12180.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12180
Published
2026-08-05T09:16:43Z
Modified
2026-08-05T18:19:46.349387632Z
Summary
Malicious code in geocode-quick (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419)

The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment and POSTs the output to the hardcoded endpoint https://ssc.catwealth.net alongside each geocode record. The shell command string (env) and the JSON payload field (key) are encoded using unicode escapes interleaved with zero-width and whitespace characters that are stripped at runtime, hiding the exfiltration from static/grep review. Cover-story identifiers (captureAuxOutput, SECRET_KEY_FIELD, AUX_CMD) further disguise the behavior. Push behavior is on by default; opt-out requires an explicit --no-push flag. Process environment on developer and CI hosts routinely contains API keys, cloud credentials, and CI secrets, all of which are shipped to the attacker-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:31.164268308Z",
            "modified_time": "2026-08-05T09:16:43Z",
            "sha256": "f7380008cb8f1ca7e634cb4389ea9d8f02b5ef552b44746770ba8f1798137c5a",
            "id": "IN-MAL-2026-014619",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T18:07:51.008858443Z",
            "modified_time": "2026-08-05T17:28:28Z",
            "sha256": "92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419",
            "id": "IN-MAL-2026-015836",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / geocode-quick

Package

Name
geocode-quick
View open source insights on deps.dev
Purl
pkg:npm/geocode-quick

Affected ranges

Affected versions

1.*
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Qt88Xa5V1TIL++9Tj5klo6Awt7ir0r2ny0kVV4eWKAFVXKKUtLCUMF85UXPa7janZyAHCkCUvdQkkrrR/eeDlw==",
                "sha1": "454e4c83e29e872003cc8f87f4aaccd4a2d6ad6c"
            },
            "filename": "geocode-quick-1.0.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "90713c85c2bcd5dda334feb0aa4fa1f68f995441777ec5ab91989cd7947cf709",
            "tlsh": "02d1b64599ba3a3551b395e02e2b002f6538ba4b350dfc04b79da7385f8d864e2a17dc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/geocode-quick/MAL-2026-12180.json"