MAL-2026-12671

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dc-renewals-layout2/MAL-2026-12671.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12671
Published
2026-08-05T13:19:02Z
Modified
2026-08-05T14:36:18.719679395Z
Summary
Malicious code in dc-renewals-layout2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113)

The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the installer's hostname, username, current working directory, configured npm registry, and CI repository slug environment variables as query parameters. The 9999.0.0 version combined with the /depconfuse endpoint path is the fingerprint of a dependency-confusion reconnaissance beacon: the CI repository slug reveals the names of the installer's private internal packages/repos, which enables targeted follow-on dependency-confusion attacks against the installer's organization. The destination is a hardcoded bare IP on a non-standard port with no relation to the package's declared purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:19:02Z",
            "source": "amazon-inspector",
            "sha256": "6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113",
            "import_time": "2026-08-05T14:19:47.980258207Z",
            "id": "IN-MAL-2026-014970",
            "versions": [
                "9999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dc-renewals-layout2

Package

Name
dc-renewals-layout2
View open source insights on deps.dev
Purl
pkg:npm/dc-renewals-layout2

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dc-renewals-layout2-9999.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-QPXcpa5kw7ft2Bhc7mlTdkXzzT/n0cUmKDnqvEsroYDGLbJH7moRHM/8voLeibLwxApdYDgE6zRKkDuGX7iyEg==",
                "sha1": "26e73a8109c2789b01127f617dbda531bad52ffb"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "9f117fb9c68c1c3419c2178479696c1eb8fbd29133c294917f2d71d267b227446b71bd",
            "sha256": "4266edee3091b25a6a5f5038deddd0bbfe587a8d01ad0b9377fc20cecea34b07",
            "path": "callback.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dc-renewals-layout2/MAL-2026-12671.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]