MAL-2026-13454

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/poc-ch4rlygr/MAL-2026-13454.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13454
Published
2026-08-06T19:09:42Z
Modified
2026-08-06T23:50:18.883367049Z
Summary
Malicious code in poc-ch4rlygr (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04)

On require()/import, index.js collects os.hostname(), os.arch(), _dirname, os.userInfo().username, and the full contents of process.env (serialized via Object.entries(process.env)) and issues an HTTPS GET carrying that data as a querystring to the hardcoded host zuxsp9k9vyk5y45z1n2hv0orhin9b2zr.oastify.com (a Burp Collaborator / OAST subdomain identified in-source as the receiver). Any secrets present in the installer's environment at load time (AWS*, NPMTOKEN, GITHUBTOKEN, CI provider tokens, etc.) are leaked verbatim to that endpoint. package.json also declares a postinstall of node tu-script.js, but tu-script.js is not shipped in the tarball; the import-time module code is the operative exfiltration path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.5.0"
            ],
            "id": "IN-MAL-2026-016746",
            "import_time": "2026-08-06T23:25:07.170313738Z",
            "modified_time": "2026-08-06T19:11:41Z",
            "source": "amazon-inspector",
            "sha256": "15d14c84f5679a5693ff177aa1dd25ba927b3f58fd7f2b2e757605060e178c96"
        },
        {
            "modified_time": "2026-08-06T19:11:57Z",
            "id": "IN-MAL-2026-016748",
            "import_time": "2026-08-06T23:25:07.306903172Z",
            "versions": [
                "1.3.0"
            ],
            "source": "amazon-inspector",
            "sha256": "e318d841681c602bebf435c71e911f64c5908799fd72607164afd5a14089b513"
        },
        {
            "versions": [
                "1.4.0"
            ],
            "id": "IN-MAL-2026-016747",
            "import_time": "2026-08-06T23:25:07.224433353Z",
            "modified_time": "2026-08-06T19:11:49Z",
            "source": "amazon-inspector",
            "sha256": "341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04"
        },
        {
            "versions": [
                "1.2.0"
            ],
            "id": "IN-MAL-2026-016749",
            "import_time": "2026-08-06T23:25:07.393623136Z",
            "modified_time": "2026-08-06T19:12:05Z",
            "source": "amazon-inspector",
            "sha256": "4cb2a37c001854866c3e211a5bdd9a87605e612f1e6b35a593652d652e5d4446"
        },
        {
            "modified_time": "2026-08-06T19:12:28Z",
            "id": "IN-MAL-2026-016752",
            "import_time": "2026-08-06T23:25:07.531147267Z",
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector",
            "sha256": "862b5fd1c8adf96b9936b92e17179f61f423806d9768c8db91de9e1e3d8d48c4"
        },
        {
            "versions": [
                "1.6.0"
            ],
            "id": "IN-MAL-2026-016742",
            "import_time": "2026-08-06T23:25:06.904694259Z",
            "modified_time": "2026-08-06T19:09:42Z",
            "source": "amazon-inspector",
            "sha256": "dde1962aa6971bfb1d042bfb0b96da389f7f727d898d18cab7fd8738bcd960ee"
        }
    ]
}
References
Credits

Affected packages

npm / poc-ch4rlygr

Package

Name
poc-ch4rlygr
View open source insights on deps.dev
Purl
pkg:npm/poc-ch4rlygr

Affected ranges

Affected versions

1.*
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-OIMPKxHlaPalUEVWvETHO3pVfXN+aNda9I+okf1qRWjfPsRom9Quoswosny7EQvRTUcnMvfF6ZesWTiiRusiZA==",
                "sha1": "0402d71add5f30ff48fb25a2314cb51f207e4940"
            },
            "filename": "poc-ch4rlygr-1.5.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "b13165a660e42ea06cf7f1c0f7997417655b8b40b819f4f43a4e439897cc9b887216fb",
            "sha256": "f7d642d44b5c3308b59365fe78b7d42fecce36ff6a81057f49d1f2d832cf6f72"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/poc-ch4rlygr/MAL-2026-13454.json"