MAL-2026-12400

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/matlab-azure-devops-extension/MAL-2026-12400.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12400
Published
2026-08-05T13:02:02Z
Modified
2026-08-05T13:35:37.136979127Z
Summary
Malicious code in matlab-azure-devops-extension (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b)

The package's preinstall script (node index.js) auto-executes on npm install and collects host identifiers (os.hostname(), os.userInfo().username, home directory, DNS servers) along with the contents of /etc/passwd and /etc/hosts, then POSTs them via HTTPS to a hardcoded Burp Collaborator subdomain at 2ru8qr34u3so6bnti176tzt30u6muci1.oastify.com. The package name mimics an Azure DevOps MATLAB extension but ships no legitimate functionality (empty author, empty description); the package exists only to run the exfil beacon. Consistent with a dependency-confusion / recon probe.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:02:02Z",
            "source": "amazon-inspector",
            "sha256": "ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b",
            "import_time": "2026-08-05T13:08:51.347114863Z",
            "id": "IN-MAL-2026-014856",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / matlab-azure-devops-extension

Package

Name
matlab-azure-devops-extension
View open source insights on deps.dev
Purl
pkg:npm/matlab-azure-devops-extension

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "9e412399a2d917330dd210c06a0c70813359fa777259a89076cf43d69f8a9f8b7326f3",
            "sha256": "ddea2c2400c432c397364778b7f864fb32193762266f426e078e87a0df6f6c97",
            "path": "index.js"
        },
        {
            "tlsh": "62d02e340d21613329c402628c2b9453b3b28e2f04143c0863cb182c91cea7b98fb30e",
            "sha256": "1f9b415baf29325293deccf5bf2a4a99e60ef7e6618ba57674534b6fd20a9d35",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/matlab-azure-devops-extension/MAL-2026-12400.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]