MAL-2026-13442

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/content-common/MAL-2026-13442.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13442
Published
2026-08-06T16:16:52Z
Modified
2026-08-06T23:50:08.921580563Z
Summary
Malicious code in content-common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b)

content-common@99.9.9 declares a preinstall lifecycle script in package.json that executes node -e to perform an HTTP GET to a unique subdomain of oastify.com (Burp Suite Collaborator): http://fyhmr907kt8qphysiu67m1p00r6iu8ix.oastify.com. This fires automatically on npm install, confirming arbitrary code execution on the installer's host and leaking the installer's public IP and DNS resolver metadata via the unique subdomain lookup to the attacker-controlled collaborator endpoint. The package's self-declared 'Mozilla bug bounty PoC' framing does not change the behavior: any consumer who installs this version triggers the out-of-band callback. The version number 99.9.9 is also consistent with a dependency-confusion / typosquat probe against an internal package name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b",
            "modified_time": "2026-08-06T16:16:52Z",
            "versions": [
                "99.9.9"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016669",
            "import_time": "2026-08-06T18:09:03.645180731Z"
        }
    ]
}
References
Credits

Affected packages

npm / content-common

Package

Name
content-common
View open source insights on deps.dev
Purl
pkg:npm/content-common

Affected ranges

Affected versions

99.*
99.9.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/content-common/MAL-2026-13442.json"
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "5b305d4502a3bcb1f379b145c02809deed28d9130ea8f51707076432c0f66b90",
            "tlsh": "b0e020f40900e72b14c985f544765406e0959e475114ac485bdb241d42e9e67b4bd18c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "55b25b863804272856b6597abfc805d1a254cfa6",
                "sha512_sri": "sha512-4SZe8bkOpOc7tzfKHHXAv3gNdLm02jwDqLj8l3zxXK/vLu3FfSrncKN9iclIUZ8gY6r74TkPWfRlD3flXsZbsw=="
            },
            "filename": "content-common-99.9.9.tgz"
        }
    ]
}