MAL-2026-12419

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pp-react-worldready-v5/MAL-2026-12419.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12419
Published
2026-08-05T13:02:28Z
Modified
2026-08-05T13:35:46.863052926Z
Summary
Malicious code in pp-react-worldready-v5 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39)

The tarball contains only package.json and vishu.js; the declared main (index.js) is absent, so the package has no library functionality. package.json.scripts.preinstall runs node vishu.js, which fires automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads os.hostname() and GitHub Actions environment variables (CI, GITHUBACTIONS, GITHUBWORKFLOW, GITHUBRUNID, GITHUBRUNNUMBER, GITHUBRUNATTEMPT), and sends them as query parameters in an HTTPS GET to https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110. It also issues a DNS lookup for ping-<hostname>.your-collab-domain.oastify.com, encoding the installer's hostname as a subdomain of a Burp Collaborator (OAST) host for out-of-band exfiltration. The package name resembles a typosquat pattern consistent with dependency-confusion reconnaissance.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T13:08:51.522219587Z",
            "modified_time": "2026-08-05T13:02:28Z",
            "id": "IN-MAL-2026-014859"
        }
    ]
}
References
Credits

Affected packages

npm / pp-react-worldready-v5

Package

Name
pp-react-worldready-v5
View open source insights on deps.dev
Purl
pkg:npm/pp-react-worldready-v5

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "7c5491fb6c0837b9d7fb20a78bbaf970e525dd3e",
                "sha512_sri": "sha512-NM21AsFB7MDKbGyNisc5+oKNqt31S+Q92n7kOGrB1uhzsOTzT1y99yCnAfJY0AT+F7Nz1x0rL7JNEshqziO1DQ=="
            },
            "filename": "pp-react-worldready-v5-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "vishu.js",
            "sha256": "2ce5acaf6ac8cd77b4bc4a8329d6f39831cc2e2ed739a0bd1a9284789ba7aa1f",
            "tlsh": "bd313e4ca2f7962004f263c8162b941e605be1933729ce917a9c02521faad3882e3bd8"
        },
        {
            "path": "package.json",
            "sha256": "3e3a925310ab66b356a8282b256a5ceda91e22624c8cc6441f940141d1b9ff52",
            "tlsh": "91e0c2744e11a2b716c109960d2a944232a54f6f11587c486beb1428418f7b788bf36d"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pp-react-worldready-v5/MAL-2026-12419.json"