MAL-2026-12368

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electrode-ota-ui-app/MAL-2026-12368.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12368
Published
2026-08-05T13:02:11Z
Modified
2026-08-06T23:50:12.372096347Z
Summary
Malicious code in electrode-ota-ui-app (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498)

Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both main: index.js and scripts.postinstall: node index.js, so on npm install and on any require() the package unconditionally runs collectAndSend() in index.js. That function gathers host identifiers via os.hostname(), os.userInfo(), os.platform(), and os.release(), resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:02:11Z",
            "id": "IN-MAL-2026-014857",
            "import_time": "2026-08-05T13:08:51.400271176Z",
            "sha256": "6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498",
            "versions": [
                "99.0.1"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T16:20:16Z",
            "sha256": "1b5315221101990fa53b188dbc05de9e41f0a8663ea645f638237a46e0e1d622",
            "import_time": "2026-08-06T18:09:04.74363334Z",
            "id": "IN-MAL-2026-016677",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / electrode-ota-ui-app

Package

Name
electrode-ota-ui-app
View open source insights on deps.dev
Purl
pkg:npm/electrode-ota-ui-app

Affected ranges

Affected versions

99.*
99.0.0
99.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "electrode-ota-ui-app-99.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-yUkqBrnBAwEvHy1SnXp82PxvHZXZIxuPqYyzk7DMfgzMnudOXbPtPuytKKcCEFSTlKysfpmNqtP504f3kA3GFg==",
                "sha1": "9bc5f2833bb5cd0dd45521325487bb50933287d0"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d971ffba15f5523476f3e29dc60b82012112f1473e45ae69798c33905fcd62a63b27f9",
            "sha256": "fde8a46daff69f5a26679e3181413871cbe2e8df62ac807439ee8398aaa40f89",
            "path": "index.js"
        },
        {
            "tlsh": "1ae06159eb45f365091f06eff06075b55135a05ae0ae45c0a14c48fad807695151e11f",
            "sha256": "1851a185b9ad284f1227a2d49f2c46d2b66a4ebcdf16d7ad67ed695ee9ea77ae",
            "path": "README.md"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electrode-ota-ui-app/MAL-2026-12368.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]