MAL-2026-12491

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uploader-frontend/MAL-2026-12491.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12491
Published
2026-08-05T13:06:25Z
Modified
2026-08-05T13:36:23Z
Summary
Malicious code in uploader-frontend (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911)

The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username (via os.userInfo().username), hostname (os.hostname()), and current working directory basename, encodes them as a subdomain, and issues a dns.resolve4 lookup against the hardcoded attacker domain oob.sl4x0.xyz — a DNS out-of-band beacon that exfiltrates installer identity. The require targets (dns, os, process), the API names (userInfo, username, hostname, cwd, resolve4), and the destination domain are reconstructed at runtime from String.fromCharCode numeric arrays to hide the destination and the APIs used. Package name and README advertise uploader-frontend / enterprise utilities and validation, but the auto-executed code implements no such functionality — only the beacon. The author email research@sl4x0.xyz shares the domain of the exfil host, and homepage points at an unrelated project (github.com/slaxorg/nms-dashboard-js), indicating publisher-controlled attacker infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014884",
            "import_time": "2026-08-05T13:08:52.92941656Z",
            "modified_time": "2026-08-05T13:06:25Z",
            "sha256": "434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911",
            "source": "amazon-inspector",
            "versions": [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / uploader-frontend

Package

Name
uploader-frontend
View open source insights on deps.dev
Purl
pkg:npm/uploader-frontend

Affected ranges

Affected versions

9.*
9.9.11

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"
        },
        {
            "path": "lib/b02e30.js",
            "sha256": "7e5dffc0070dfd23371f2f41227b1e3b0f81b85bfaf4fe87e35c5c64e5ddd748",
            "tlsh": "87e068077307c94fa1c80bf77e0050e1ba0d8b59a15dc0d6b518678500af443c1c0232"
        },
        {
            "path": "package.json",
            "sha256": "0247cc50a0a57a241e6eda6714516e5864f23389977049c30052cfb3a69abd2f",
            "tlsh": "01215b35ce244c236ec86aa49c692a42f5a24c174d407c1973c7912c8fef26f51bf65d"
        }
    ],
    "package_integrity": [
        {
            "filename": "uploader-frontend-9.9.11.tgz",
            "hashes": {
                "sha1": "5af34c2336d4d04a61dfc054b87749c878df4b02",
                "sha512_sri": "sha512-ERPOwIjslWpFmQQAd6L0n91vaFjFGhD3lGCTkM6srdH3dQ5dusYjqXcrhHuiVmFksOqfBGFXFKu9q8380WKToA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uploader-frontend/MAL-2026-12491.json"