MAL-2026-13753

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dcfarguscert/MAL-2026-13753.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13753
Published
2026-08-11T18:49:55Z
Modified
2026-08-11T19:00:11Z
Summary
Malicious code in dcfarguscert (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d)

dcfarguscert@999.0.1 registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host identifiers (os.hostname(), os.userInfo().username, OS release, process.platform, process.arch, Node version, CI flag) and the output of npm ls -g --depth=0 --json (the installer's globally installed npm package inventory), then POSTs the aggregated payload over plain HTTP to the hardcoded endpoint http://16-171-38-148.sslip.io:8080/api/install (bare IP 16.171.38.148 encoded via sslip.io). The version number 999.0.1 and the package description referencing a 'dependency test' with 'check ips' are consistent with a dependency-confusion beacon that fires unconditionally on install without any user consent or opt-out.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017385",
            "import_time": "2026-08-11T18:52:01.245629786Z",
            "modified_time": "2026-08-11T18:49:55Z",
            "sha256": "6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d",
            "source": "amazon-inspector",
            "versions": [
                "999.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dcfarguscert

Package

Name
dcfarguscert
View open source insights on deps.dev
Purl
pkg:npm/dcfarguscert

Affected ranges

Affected versions

999.*
999.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/telemetry.js",
            "sha256": "1f1be8d93d6662e5a407368e69d56ec0521f8e6a280e51910175e6ab7eacfd57",
            "tlsh": "243133e284f85b301ae94d85faa8140732bff1237b09f8f6b4ed12552f496da0073365"
        }
    ],
    "package_integrity": [
        {
            "filename": "dcfarguscert-999.0.1.tgz",
            "hashes": {
                "sha1": "a7f5bb81f63a3fd12c2e959620cc9a21f6751fac",
                "sha512_sri": "sha512-xnQTOTs3mYKAfkePsaiwEAUsk+kA60bodWIQWLES5YAeEVgpNzgt0889x1isj1d2Xg1ScOVK6bfhKqeDtl7UYQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dcfarguscert/MAL-2026-13753.json"