MAL-2026-13882

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/verify-cli/MAL-2026-13882.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13882
Published
2026-08-12T14:02:43Z
Modified
2026-08-12T14:45:10.488090736Z
Summary
Malicious code in verify-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b)

package.json declares preinstall: node index.js, which runs automatically on npm install. index.js shells out via child_process and curl to POST the installer's whoami, hostname, and id output along with base64-encoded contents of /etc/passwd, /etc/hosts, and (if readable) /etc/shadow to a hardcoded out-of-band interactsh/OAST endpoint at 5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site. Package metadata shows an implausible version (99.0.0), placeholder description ("Nodejs SDK for Redacted"), and a nonexistent dependency, consistent with a dependency-confusion / typosquat beacon rather than a legitimate SDK.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017574",
            "import_time": "2026-08-12T14:31:16.792975428Z",
            "sha256": "081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b",
            "modified_time": "2026-08-12T14:02:43Z",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / verify-cli

Package

Name
verify-cli
View open source insights on deps.dev
Purl
pkg:npm/verify-cli

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "aff0dc8b0df4e83177a5087cdb04541f775bfac45076f35220af4a0c239c488446a1e6",
            "sha256": "19d9b30804000e68cb481de23f85e71eb47b3d17d638e8497992885bb69e6ba1"
        },
        {
            "path": "package.json",
            "tlsh": "d6e08c241d61667325ca16e1886ad447a2a28e6b00087c0966db143c41aebb7a9ff25c",
            "sha256": "b53011035e240dd841072714498ec44a7f15a5ae8754b271d585176c9a9507eb"
        }
    ],
    "package_integrity": [
        {
            "filename": "verify-cli-99.0.0.tgz",
            "hashes": {
                "sha1": "7465488b926bdcf3e4b7ff619200e1c325275f9e",
                "sha512_sri": "sha512-4SqenxfpfOM7iSHYZwJu77J7cYQwFseJ2ykqkZM93VTFctpXzRgz6UQXvIbZNyAhoShNGiZbUBoj46YMJU4ZCg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/verify-cli/MAL-2026-13882.json"