MAL-2026-13453

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pilgrimage-portal-client/MAL-2026-13453.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13453
Published
2026-08-06T16:22:23Z
Modified
2026-08-06T23:50:18.302693469Z
Summary
Malicious code in pilgrimage-portal-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28)

On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require('os').hostname() and POSTs it, along with a timestamp and the package name/version, to the hardcoded bare-IP endpoint http://134.119.222.10:9009/canary over plain HTTP. Errors and timeouts are silently swallowed. The version number (99.0.0) and beacon shape are consistent with a dependency-confusion proof-of-install callback: the destination is a non-first-party bare IP the installer never configured, and the outbound call fires automatically without user consent. Regardless of the 'canary' self-label, host-identifier data leaves the installer's machine to an attacker-controlled endpoint at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T16:22:23Z",
            "source": "amazon-inspector",
            "sha256": "73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28",
            "import_time": "2026-08-06T18:09:05.465823142Z",
            "id": "IN-MAL-2026-016681",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / pilgrimage-portal-client

Package

Name
pilgrimage-portal-client
View open source insights on deps.dev
Purl
pkg:npm/pilgrimage-portal-client

Affected ranges

Affected versions

99.*
99.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "pilgrimage-portal-client-99.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-iR3YIZ5nCgbznW0gm8io4WF9DTMjWQgONk3qMDgj6qaFtaV+bdNIi9eRd1p6dEtsZzercsX2GR1eRaaa11cIhA==",
                "sha1": "a13608f4df73c887187256fb4fcb1858cd7bff81"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "2cf002e552e0f6262df5f2c0f0f5980b4331e021f71b68e0d6c913157a8c6a967b75d0",
            "sha256": "585e5dc0ccdb08b9d887f8159d49a63d2e7467184a35c9e7923627705beaaecf",
            "path": "ping.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pilgrimage-portal-client/MAL-2026-13453.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]