MAL-2026-12790

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/glia-functions-tools/MAL-2026-12790.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12790
Published
2026-08-05T13:17:51Z
Modified
2026-08-05T14:37:12.873889002Z
Summary
Malicious code in glia-functions-tools (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626)

package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads /etc/passwd and /etc/hosts, and HTTPS-POSTs the JSON payload to a hardcoded Burp Collaborator (oastify.com) subdomain. The exfiltration fires automatically on npm install without any user interaction, and targets installer-side system identity and account data.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:17:51Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014962",
            "import_time": "2026-08-05T14:19:47.176565391Z",
            "sha256": "e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626",
            "versions": [
                "0.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / glia-functions-tools

Package

Name
glia-functions-tools
View open source insights on deps.dev
Purl
pkg:npm/glia-functions-tools

Affected ranges

Affected versions

0.*
0.2.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "96412395a2ca17330dd214c06a0c70812359fa777269e9d076cf42d69f869f8b7326f3",
            "sha256": "19fc2fcfeb2e8d348727f6b29e7a7ffdbee53998625fea6d8ab9e799a1418a55",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/glia-functions-tools/MAL-2026-12790.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]