MAL-2026-12336

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/afisha-storybook-default/MAL-2026-12336.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12336

Published

2026-08-05T12:46:27Z

Modified

2026-08-05T13:34:56.721033105Z

Summary

Malicious code in afisha-storybook-default (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13)

On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts (package-proxy.cf*.workers.dev, tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) and platform-specific asset paths (/pkg/package, /pkg/loadermac, /pkg/package.exe). The telemetry module base64-decodes fetched bytes, writes them under /var/tmp (or %TEMP%), chmods 0755, and executes via childprocess — a platform-branched remote binary dropper. Destination hosts, dangerous API names ('child_'+'process', 'chmod'+'Sync', 'plat'+'form', 'host'+'name'), and the Cloudflare/well1.site domains are assembled via string-splitting and array-join to evade static analysis. setup.js also builds an install fingerprint (sha256 over os.hostname(), os.userInfo().username, process.cwd(), process.version, process.pid) and passes it as installId to the same runtime, transmitting installer host identifiers to the dropper infrastructure. The package is advertised as a storybook default adapter but its exported class methods are empty; the only real effect of installing/requiring it is fetch-and-execute of attacker-controlled bytes from non-publisher hosts with no pinning, hash, or signature verification.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:52:32Z",
            "source": "amazon-inspector",
            "sha256": "08c5b1885bffe891f70f75812da1a2776cbf12ce3fdf4980186df6b98a809482",
            "import_time": "2026-08-05T13:08:47.112538675Z",
            "id": "IN-MAL-2026-014796",
            "versions": [
                "9.7.11"
            ]
        },
        {
            "modified_time": "2026-08-05T12:46:27Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014755",
            "import_time": "2026-08-05T13:08:43.9962637Z",
            "sha256": "76a6bb4250d33de107f80842cbf49923b66aac5a249ade8a71dc5735653cd3d3",
            "versions": [
                "9.7.12"
            ]
        },
        {
            "modified_time": "2026-08-05T12:46:52Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014758",
            "import_time": "2026-08-05T13:08:44.255760789Z",
            "sha256": "e3623608b260ad43eac6b272a5695a8cbdbd8f3ee106517eb86345f2463590e9",
            "versions": [
                "9.7.10"
            ]
        },
        {
            "modified_time": "2026-08-05T12:47:00Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014759",
            "import_time": "2026-08-05T13:08:44.320459586Z",
            "sha256": "fa80e94dac286c4c7c92e371d206753ef67d200c0611816c6aca3041ff6e061b",
            "versions": [
                "12.1.1"
            ]
        },
        {
            "modified_time": "2026-08-05T12:56:58Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014820",
            "import_time": "2026-08-05T13:08:49.001301036Z",
            "sha256": "feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13",
            "versions": [
                "9.7.9"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / afisha-storybook-default

Package

Name: afisha-storybook-default; View open source insights on deps.dev
Purl: pkg:npm/afisha-storybook-default

Affected ranges

Affected versions

9.*

9.7.9

9.7.10

9.7.11

9.7.12

12.*

12.1.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/afisha-storybook-default/MAL-2026-12336.json"

indicators

{
    "package_integrity": [
        {
            "filename": "afisha-storybook-default-9.7.11.tgz",
            "hashes": {
                "sha512_sri": "sha512-nyjgafTfsh32FKWMG2GLzIngy6I8nNjX/WiBGa0iZElh9sExLzQUHHcijeBldur4O4DOICJdAQlDabh2A6qKpA==",
                "sha1": "36bbffbd6bd3e4dc15168f129523eff4292ddd26"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "689162080ed565250284e3e56a2a4447e89604433ac8f6487a4ff35c5f98139877ffaf",
            "sha256": "c454425e09c22cca6cbc55d69b91646eea3ce307fd6a117915a0532ede076af6",
            "path": "setup.js"
        },
        {
            "tlsh": "09733f4966fb1021826370685fbb40437635c4072a4aed5dba9c43ec9f8db3896f1fb9",
            "sha256": "9d47715b5018d122cfe498587342ccd84ae4ea142d15c78dc4681b0a6efd4460",
            "path": "lib/telemetry.js"
        }
    ]
}

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]