MAL-2026-13664

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/titan-exchange-shared-permissions/MAL-2026-13664.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13664
Published
2026-08-08T00:52:01Z
Modified
2026-08-08T01:04:55.764818888Z
Summary
Malicious code in titan-exchange-shared-permissions (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6)

titan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (node index.js) that runs automatically on npm install; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6",
            "source": "amazon-inspector",
            "versions": [
                "99.9.9"
            ],
            "import_time": "2026-08-08T00:53:09.991992004Z",
            "modified_time": "2026-08-08T00:52:01Z",
            "id": "IN-MAL-2026-017196"
        }
    ]
}
References
Credits

Affected packages

npm / titan-exchange-shared-permissions

Package

Name
titan-exchange-shared-permissions
View open source insights on deps.dev
Purl
pkg:npm/titan-exchange-shared-permissions

Affected ranges

Affected versions

99.*
99.9.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "f6a0bccc56cb491aef85168e2a4c4767227bc636",
                "sha512_sri": "sha512-psaLwuosIa0HlXl32dwmCp5DZcT8WDdctaRHmhEEstaxJ4oHANpMbBM8DRTe4XhxEtZ4uUSKQw5TXM+manI7lA=="
            },
            "filename": "titan-exchange-shared-permissions-99.9.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "dfbe84616bd17c7face74fa85caa3edf3c54163331e96e3009717837407aecb3",
            "tlsh": "a501f4f5517bf5740e6813e1d805ec0de763e121700595e05628c3ec6bd69f41670d9c"
        },
        {
            "path": "package.json",
            "sha256": "a183c41e4efaafed57b8f7d2422115b7a5c0d80d9d308730a97d1a38f78d4022",
            "tlsh": "2ed023305d14673368c8069d4c7b740675a14d1f010c341d4793542890ef97348ff31e"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/titan-exchange-shared-permissions/MAL-2026-13664.json"