MAL-2026-12386

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fundraiserservpp/MAL-2026-12386.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12386
Published
2026-08-05T12:59:29Z
Modified
2026-08-05T16:51:02.939031647Z
Summary
Malicious code in fundraiserservpp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8)

fundraiserservpp@2.0.0 runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machine — os.hostname(), os.platform(), os.arch(), the user home directory path, and configured DNS servers — and issues an HTTPS POST to a hardcoded Burp Collaborator subdomain (mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit) with that data as a JSON body. The beacon fires automatically at install time with no user interaction. The destination is an attacker-controlled out-of-band interaction endpoint typical of dependency-confusion reconnaissance, confirming to the operator that the package name was successfully resolved and installed inside a target build environment.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T13:08:50.221303978Z",
            "modified_time": "2026-08-05T12:59:29Z",
            "sha256": "542a9a32b033b5188849fa81e6ec448528308f1251256d861ee7917a7cdcb473",
            "id": "IN-MAL-2026-014837",
            "versions": [
                "1.9.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T16:13:47.616663509Z",
            "sha256": "0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8",
            "modified_time": "2026-08-05T15:52:56Z",
            "id": "IN-MAL-2026-015807",
            "versions": [
                "2.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / fundraiserservpp

Package

Name
fundraiserservpp
View open source insights on deps.dev
Purl
pkg:npm/fundraiserservpp

Affected ranges

Affected versions

1.*
1.9.0
2.*
2.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Iok3BkQbCVAQeDRksJMKTCAmPtt9qLKC8UivPZjVnAaRkdwMJDzfvsM5wicAzhvx6MeAmIIhZV85sXHolnJbFA==",
                "sha1": "dfb6a2a99627b2ac502aba8eeb2f914ac2316178"
            },
            "filename": "fundraiserservpp-1.9.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "268e7088c0eb0140719c86be7d00da47f74f03875183b8bd3b48d6d4b9c6e863",
            "tlsh": "aff081d4e6f55a710b7699d0b0a255069333d662740ff4d05fc8027607cddf801b16f4"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fundraiserservpp/MAL-2026-12386.json"