MAL-2026-12794

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/karapace-docs/MAL-2026-12794.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12794
Published
2026-08-05T13:13:22Z
Modified
2026-08-05T14:37:14.688576251Z
Summary
Malicious code in karapace-docs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686)

The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, then POSTs a JSON payload over HTTPS to a hardcoded Burp Collaborator subdomain n6usddpvkn7jcauar9va0xvleck48uwj.oastify.com. The package name mimics a documentation package for karapace (a Kafka registry project), consistent with a dependency-confusion / typosquat recon payload. Installer host identity and local system file contents leave the machine to an attacker-controlled OAST endpoint on npm install with no user interaction.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:13:22Z",
            "id": "IN-MAL-2026-014931",
            "import_time": "2026-08-05T14:19:44.128561091Z",
            "sha256": "a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / karapace-docs

Package

Name
karapace-docs
View open source insights on deps.dev
Purl
pkg:npm/karapace-docs

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "karapace-docs-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-r/d30OVteLMefWcjBXqVjVqjKvHPuSjA+vzc2uIY/0rlOY4XZtNL9q92yJaHrtdg5kkPH6HplKMTEwHVVFQ86g==",
                "sha1": "17ddfe5f3363f2d911c2d9ba8eb0598419a1a030"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "21411195a2ca17330dd210c06a0c70842359fa777259a99076cf42969f869f8bb226f3",
            "sha256": "2af0c318254adfdf6c91193e32a4ec56689d74c87a843d2758fb6e9a5f30f531",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/karapace-docs/MAL-2026-12794.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]