MAL-2026-12360

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csv-parser-helper/MAL-2026-12360.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12360
Published
2026-08-05T12:32:36Z
Modified
2026-08-05T13:35:17.151186698Z
Summary
Malicious code in csv-parser-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca)

The package is advertised as a CSV parser but ships a postinstall.js that runs on npm install and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working directory, uname -a, container indicators, process tree, and network information; probes AWS and Tencent instance metadata services at 169.254.169.254 and metadata.tencentyun.com; and dumps the full process environment while filtering out only npm noise (retaining any token/secret-shaped variables such as GITHUB_TOKEN, cloud provider keys, and CI credentials). The collected data is base64-encoded and exfiltrated via HTTP GET query string to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package's stated CSV-parsing purpose is a cover story — index.js is unrelated code and no CSV functionality is present.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:32:36Z",
            "source": "amazon-inspector",
            "sha256": "90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca",
            "import_time": "2026-08-05T13:08:38.665035451Z",
            "id": "IN-MAL-2026-014698",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / csv-parser-helper

Package

Name
csv-parser-helper
View open source insights on deps.dev
Purl
pkg:npm/csv-parser-helper

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "csv-parser-helper-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-crpnaO+txiJ9xoMLQVjCn/BZlIKaraujwrD3WgPHZwk0jInKKlOGtgKJ74Hq2xXhPLPCUi20NAgcz8w36yoT4Q==",
                "sha1": "8c59ca801f11e1ffa9fc29aaf7ade649b9cba428"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "8931fbf8b56ded72304dc5f8b75d14053846eaeb58e4ff74281b8875008e48420a9136",
            "sha256": "5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9",
            "path": "postinstall.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csv-parser-helper/MAL-2026-12360.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]