MAL-2026-13952

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/global-intel/MAL-2026-13952.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13952
Published
2026-08-13T17:22:23Z
Modified
2026-08-13T17:30:14.042937428Z
Summary
Malicious code in global-intel (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer — os.hostname(), os.userInfo(), homedir, DNS server configuration, /etc/passwd, /etc/hosts, and package metadata — and HTTPS POSTs the payload to the hardcoded out-of-band host 0gh240ybp2rb80iyzrg4w2o3tuzlncb1.oastify.com (Burp Collaborator). The exfiltration fires automatically as a lifecycle side effect of installation with no user interaction.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017662",
            "import_time": "2026-08-13T17:24:46.368786974Z",
            "sha256": "5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T17:22:23Z"
        }
    ]
}
References
Credits

Affected packages

npm / global-intel

Package

Name
global-intel
View open source insights on deps.dev
Purl
pkg:npm/global-intel

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/global-intel/MAL-2026-13952.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "6d412395a2d917330dd210c06a0c70852359fa777259a99076cf42d6af869f8bb326f3",
            "sha256": "9121fa1d202333b85aadaebd0680048646e1ae387bb8ea729db8267f6c9343ff"
        }
    ],
    "package_integrity": [
        {
            "filename": "global-intel-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-hZ92GChH6/CUGUxuax5a8UGas01QoGSzRW5AXRQgj1Qgc1scMhfAkdycTjJ6G87PqRRxs7X/mW43JKyhL0kNVw==",
                "sha1": "da36a3bfc9bf77e83961a27224b75f4de3026c39"
            }
        }
    ]
}