MAL-2026-12326

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@offa/offa-uwk/MAL-2026-12326.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12326
Published
2026-08-05T12:57:06Z
Modified
2026-08-05T13:35:13.636887737Z
Summary
Malicious code in @offa/offa-uwk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8)

package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname(), os.userInfo().username, process.cwd(), and the entire process.env object, then POSTs the JSON payload via https.request to the hardcoded endpoint https://e6b10849-38dc-4280-a8e3-72ab39cfaf65.webhook.site/collect. Dumping the whole process environment on install ships every environment variable on the installer's machine — commonly containing AWS/GCP/GitHub/npm and other tokens — to an anonymous attacker-controlled webhook. A preinstall hook additionally writes a marker file to the hardcoded absolute path /home/OFFA/flag.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014821",
            "import_time": "2026-08-05T13:08:49.068059338Z",
            "source": "amazon-inspector",
            "versions": [
                "999.0.1"
            ],
            "modified_time": "2026-08-05T12:57:06Z",
            "sha256": "321b84802e64efd2edf01527613d8d37aeaa63ee37505c59bf48a94f5ec88aed"
        },
        {
            "id": "IN-MAL-2026-014853",
            "import_time": "2026-08-05T13:08:51.179695274Z",
            "source": "amazon-inspector",
            "versions": [
                "999.0.0"
            ],
            "modified_time": "2026-08-05T13:01:38Z",
            "sha256": "3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8"
        }
    ]
}
References
Credits

Affected packages

npm / @offa/offa-uwk

Package

Name
@offa/offa-uwk
View open source insights on deps.dev
Purl
pkg:npm/%40offa/offa-uwk

Affected ranges

Affected versions

999.*
999.0.0
999.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "131161f0457152e06af740c0a042780e6663e9037207f814f99d83555fc8afc45a2af4",
            "path": "index.js",
            "sha256": "1a59154c39015bd7a0b6035429c3dd17c663df42a7ab239b9a78c9eaf6b12216"
        },
        {
            "tlsh": "40d0c2304e10952369c047a60c27a4467aa10e1740107c44a7e7122845dabbf44ff33e",
            "path": "package.json",
            "sha256": "f0e49be9373e4132c4bb9426c551f2bbff24278865eafb1b0611707e5334bbf7"
        }
    ],
    "package_integrity": [
        {
            "filename": "offa-uwk-999.0.1.tgz",
            "hashes": {
                "sha1": "2cf6459022c35a8cf62f708f2e0963986fd5d73b",
                "sha512_sri": "sha512-vBeTNqxieTsWkFSFj4CDPtalD3+5d7aRd+DD0NEiU6QrMhnhdUDAWMMm/66AXcqSL2owJfru5PxbXLDYjPIluw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@offa/offa-uwk/MAL-2026-12326.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]