MAL-2026-13358

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-kst-engine/MAL-2026-13358.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13358
Published
2026-08-05T17:22:35Z
Modified
2026-08-05T18:19:49.192231299Z
Summary
Malicious code in app-kst-engine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9)

On npm install, package.json's postinstall runs node test.js, which triggers three malicious paths against the installer. (1) A recursive scan of the current working directory collects files matching id.json, config.toml, Config.toml, env, and.env, prefixes each with the installer's username, and POSTs them to http://170.205.31.203:3000/api/v1. (2) Scan patterns are fetched from http://170.205.31.203:3001/api/scan-patterns and used to walk the user's home directory on Unix or enumerate every logical drive on Windows (via wmic/PowerShell), uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1. (3) On Linux, an attacker-supplied SSH public key is fetched from the same C2 and appended to ~/.ssh/authorized_keys with mode 0o600, then sudo ufw allow 22/tcp is invoked to open the firewall, granting persistent remote SSH access. The destination is a hardcoded bare-IP endpoint with no relation to any documented package purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015831",
            "import_time": "2026-08-05T18:07:50.471941577Z",
            "sha256": "08cfc426d2f4b29bba2b81f2eb56eeee32ab114338a51fae5eeced2571e6b2d9",
            "modified_time": "2026-08-05T17:22:35Z",
            "versions": [
                "2.1.6"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / app-kst-engine

Package

Name
app-kst-engine
View open source insights on deps.dev
Purl
pkg:npm/app-kst-engine

Affected ranges

Affected versions

2.*
2.1.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-m63B/uKfUcmCNsvj1RWr5FcZui+XLwtWEydPH5ojn3S0yqKmJnn+xEDK5Pzt1zOjnumilSfsKT0I8Mvk1MLYzg==",
                "sha1": "306b98eaa8833598d7ad27bebfb2e40bb543e692"
            },
            "filename": "app-kst-engine-2.1.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "d986a2e0a9eb3fc3781e166ff6b700e0d38249a6c9649982243c3754671f42d9",
            "path": "index.js",
            "tlsh": "ef02934ca6fb2a2183b371ac468f1415b59ac0033949cd81b2cc97546f8f93d65f6ede"
        },
        {
            "sha256": "8296bee9db2ba7b59b3078e94f24e8a38f4a61d7f631e390180c3c2553709ff9",
            "path": "package.json",
            "tlsh": "b9f0ed27ca588e6318f176a868bc0617f681932f4100880f35bd274c4fb61330089f1e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-kst-engine/MAL-2026-13358.json"