MAL-2026-13752

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chapters-core/MAL-2026-13752.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13752
Published
2026-08-11T18:50:36Z
Modified
2026-08-11T19:00:12.800412030Z
Summary
Malicious code in chapters-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992)

The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname(), os.userInfo().username, process.cwd(), and CI/CD attribution environment variables (GITHUBREPOSITORY, GITHUBACTOR, GITHUBRUNID, RUNNERNAME, npmconfigregistry, AWSREGION, JENKINS_URL, and similar) and transmits them via DNS lookups and HTTP/HTTPS POST to a hardcoded Interactsh callback subdomain awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun. The package name chapters-core at version 9.999.999 is shaped as a dependency-confusion squat of an internal package name, and poc.js additionally writes a marker file samsung-depconf-poc.json into the caller's working directory. Any self-labeling of the file as research does not alter the observed behavior: install-time collection of installer host identity and internal build-environment attribution and transmission to a hardcoded, non-first-party destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017389",
            "import_time": "2026-08-11T18:52:01.718049926Z",
            "sha256": "e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992",
            "versions": [
                "9.999.999"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-11T18:50:36Z"
        }
    ]
}
References
Credits

Affected packages

npm / chapters-core

Package

Name
chapters-core
View open source insights on deps.dev
Purl
pkg:npm/chapters-core

Affected ranges

Affected versions

9.*
9.999.999

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chapters-core/MAL-2026-13752.json"
indicators 
{
    "evidence_files": [
        {
            "path": "poc.js",
            "tlsh": "b291855f4498156016e3b66a119f101630e7d7fa0296fae9f00d535e0ff87e9023ada9",
            "sha256": "b23864601e7f0138e62f91cb4bd7aeb0c1bef51073705abc49e161a4ed813176"
        }
    ]
}