MAL-2026-12426

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/relativity-foundation-core/MAL-2026-12426.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12426
Published
2026-08-05T12:59:36Z
Modified
2026-09-01T11:31:19Z
Summary
Malicious code in relativity-foundation-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d)

package.json declares a preinstall script that runs a Node one-liner collecting os.hostname(), process.env.USER/USERNAME, cwd, npm_config_registry, CI, GITHUB_REPOSITORY, JENKINS_URL, and platform, base64-encodes the JSON blob, and issues an HTTPS GET to https://aiwi9di43fzbjwncfrimdvkgu701orcg.oastify.com/?d= on every npm install. index.js is empty, so the package's only effect is this reconnaissance beacon. The oastify.com destination is a Burp Collaborator subdomain used as an attacker-controlled out-of-band exfiltration sink.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014838",
            "import_time": "2026-08-05T13:08:50.275070367Z",
            "modified_time": "2026-08-05T12:59:36Z",
            "sha256": "0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d",
            "source": "amazon-inspector",
            "versions": [
                "6.8.2"
            ]
        },
        {
            "id": "RLMA-2026-06436",
            "import_time": "2026-09-01T11:17:33.968780169Z",
            "modified_time": "2026-08-24T17:08:11Z",
            "sha256": "c3b0aedbf834b382e47e304ab719cba5a41c83cd9e73a12055664d58564f5936",
            "source": "reversing-labs",
            "versions": [
                "6.8.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / relativity-foundation-core

Package

Name
relativity-foundation-core
View open source insights on deps.dev
Purl
pkg:npm/relativity-foundation-core

Affected ranges

Affected versions

6.*
6.8.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "988248624029a2a1d021e1a0ad294d799ba1e74a258f93b4bd313f95de534641",
            "tlsh": "f6f0fe2d876cc83b05d10ba025795c879cb2bdaa330898619f53b00e6fe83a2017302f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/relativity-foundation-core/MAL-2026-12426.json"