MAL-2026-12786

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dust-helpers/MAL-2026-12786.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12786
Published
2026-08-05T13:14:17Z
Modified
2026-08-05T14:37:10Z
Summary
Malicious code in dust-helpers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310)

On npm install, the package's preinstall script runs node callback.js, which collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and multiple CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, and similar) and sends them as query-string parameters in an HTTP GET to the hardcoded endpoint http://75.119.137.232:31337/depconfuse. The package is published at version 9999.0.0 with a generic description and the exfil path is literally /depconfuse, matching the dependency-confusion reconnaissance pattern: publish a very-high-version squat of an internal-sounding name to the public registry so private builds that misresolve pick it up and identify themselves to the attacker. Installer identity, working directory, internal registry URL, and internal repository slugs leave the host to an attacker-controlled bare-IP endpoint at install time, enabling targeted follow-on supply-chain intrusion against the affected organization.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014937",
            "import_time": "2026-08-05T14:19:44.721823113Z",
            "modified_time": "2026-08-05T13:14:17Z",
            "sha256": "0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310",
            "source": "amazon-inspector",
            "versions": [
                "9999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dust-helpers

Package

Name
dust-helpers
View open source insights on deps.dev
Purl
pkg:npm/dust-helpers

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "532b214d46b6378125464acd5c9ceb3428c52357fc8aa034f2a559ba5b843b55",
            "tlsh": "7e119eb9c78c0c3409c2178479696c5eb8fbe29233c2a4917f2d71d26bb227046b75bd"
        },
        {
            "path": "package.json",
            "sha256": "fd3602d8fc1da19778e6dbae77dc9db7f2095bab31fadc8799a922cfad6a11b9",
            "tlsh": "c9d0a7309b225d332cd8ffd30c6b554611768e2b06083809678b901e56ad66b19ff79d"
        }
    ],
    "package_integrity": [
        {
            "filename": "dust-helpers-9999.0.0.tgz",
            "hashes": {
                "sha1": "9bf428bb7eca35c5ec2077dd542051a132fc5022",
                "sha512_sri": "sha512-YqBASOws0apcP+TtixGdRc2RbMnBU3k5iTw+h9b56okLCFP/a8gBfULNKAl86/IKuCJpYSfrxbUKPn6kLxMRuQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dust-helpers/MAL-2026-12786.json"