MAL-2026-13433

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ks-video/kwai-player-web/MAL-2026-13433.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13433
Published
2026-08-06T16:25:56Z
Modified
2026-08-06T23:50:01.571003163Z
Summary
Malicious code in @ks-video/kwai-player-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222)

On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname(), os.userInfo().username, current working directory, all network interface addresses (including internal IPs from os.networkInterfaces()), Node.js version, and the full list of environment variable names via Object.keys(process.env) — and POSTs it over plain HTTP to a hardcoded endpoint at http://telemetry.debugnotyja.com/api/v1/install. The destination domain debugnotyja.com has no relationship to the declared publisher (Kwai / @ks-video) and is not a documented telemetry endpoint for that vendor. Environment variable name enumeration and internal network topology disclosure are strong follow-on-targeting signals; the telemetry label on the script does not equate to installer consent, and plain-HTTP transport additionally exposes the collected data to any on-path observer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "9.1.2"
            ],
            "id": "IN-MAL-2026-016695",
            "import_time": "2026-08-06T18:09:07.429228327Z",
            "modified_time": "2026-08-06T16:25:56Z",
            "source": "amazon-inspector",
            "sha256": "189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222"
        }
    ]
}
References
Credits

Affected packages

npm / @ks-video/kwai-player-web

Package

Name
@ks-video/kwai-player-web
View open source insights on deps.dev
Purl
pkg:npm/%40ks-video/kwai-player-web

Affected ranges

Affected versions

9.*
9.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "kwai-player-web-9.1.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-Rq5Hk2FhM4u+ezguUarr7CSZThFbVG4DMEe1oWsJSVdixN9n5v1N45ezld7YSrl4KorcsBBfs/EAcJm9rlmAww==",
                "sha1": "7ce5704981ee62cd4be2e1df23bd444673766ad6"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "scripts/telemetry.js",
            "tlsh": "c62168a151f1145427ab2190b066181262f2d0137807f8ec75e813e62fdedf880f9749",
            "sha256": "3a1fa260f74a0fedd38ca5a7ef54a38cf4299fa05e6f4a46dd3cf9caddf5e6e1"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ks-video/kwai-player-web/MAL-2026-13433.json"