MAL-2026-12350

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chart-data-utils/MAL-2026-12350.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12350
Published
2026-08-05T12:31:46Z
Modified
2026-08-05T13:35:03.523369019Z
Summary
Malicious code in chart-data-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9)

chart-data-utils@1.0.0 advertises itself as a chart data/color helper library (index.js contains only trivial color utilities), but ships a postinstall.js that runs at npm install time and performs credential harvesting and host reconnaissance. The postinstall shells out via childprocess.exec to: (1) collect hostname, whoami/id output, Docker/cgroup indicators, sudo -ln, ps aux, ip addr/route; (2) enumerate process environment variables and grep-filter for KEY|TOKEN|SECRET|CREDENTIAL|NPMTOKEN|AWS_|AZURE|GCP|GITHUBTOKEN plus GitHub Actions identity fields (GITHUBTOKEN, GITHUBREPOSITORY, GITHUBACTOR, RUN_ID); (3) probe cloud instance-metadata endpoints at 169.254.169.254 (AWS), 100.100.100.200 (Aliyun), metadata.google.internal (GCP), metadata.tencentyun.com (Tencent), and an internal host tst.woa.com; (4) base64-encode the collected data and POST/GET it over plain HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package name/description are a cover story for a CI credential harvester; Chinese-language comments ("分片回传版") in the postinstall reference tst.woa.com.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:31:46Z",
            "source": "amazon-inspector",
            "sha256": "3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9",
            "import_time": "2026-08-05T13:08:37.963621839Z",
            "id": "IN-MAL-2026-014692",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chart-data-utils

Package

Name
chart-data-utils
View open source insights on deps.dev
Purl
pkg:npm/chart-data-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "chart-data-utils-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-crHgDGf2OG9zQ0IHRk362t23rdcRxrJnyJigiGSGjtmGwEuz5qqAsKPjY+1y6AJAIWQKKpyWTXdKK4zmG5O7dg==",
                "sha1": "701a44eee22ef2e3819a1d6df5d544fbc45d2473"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77",
            "sha256": "b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84",
            "path": "postinstall.js"
        },
        {
            "tlsh": "13e07d30e91096332dc597a92d97c2013b315d0712083c4817972518439f2f1e0ffb1d",
            "sha256": "77a52dfc0e1a660cb457ebfbc70984acce594f37af10c0519c366c6d5f16ba15",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chart-data-utils/MAL-2026-12350.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]