MAL-2026-14019

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fr-ito-web-react/MAL-2026-14019.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14019
Published
2026-08-14T06:50:50Z
Modified
2026-08-14T14:46:34Z
Summary
Malicious code in fr-ito-web-react (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e)

Package's package.json declares both preinstall and postinstall lifecycle hooks that execute node exfil.js on npm install. exfil.js runs whoami and id via child_process.execSync and transmits the output to the hardcoded host d9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site over HTTPS POST with TLS verification disabled (rejectUnauthorized: false), with a DNS lookup fallback that encodes the whoami output as a hex subdomain of the same collector. The package uses version 99.99.99, a typical dependency-confusion cover version to force resolution over an internal package of the same name. Installer identity and host data leaves the machine to an attacker-controlled interactsh/OAST collector without user interaction.

Source: ossf-package-analysis (bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1)

The OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-08-14T07:36:27.928352726Z",
            "modified_time":  "2026-08-14T06:50:50Z",
            "sha256":  "bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1",
            "source":  "ossf-package-analysis",
            "versions":  [
                "99.99.99"
            ]
        },
        {
            "id":  "IN-MAL-2026-017725",
            "import_time":  "2026-08-14T14:28:03.194179008Z",
            "modified_time":  "2026-08-14T13:49:08Z",
            "sha256":  "1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e",
            "source":  "amazon-inspector",
            "versions":  [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fr-ito-web-react

Package

Name
fr-ito-web-react
View open source insights on deps.dev
Purl
pkg:npm/fr-ito-web-react

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "exfil.js",
            "sha256":  "222ebe92d681b64f7b56b3ffaf639e05418b9921743759fcc6aa9e37cf57ddf0",
            "tlsh":  "c32187fa41f5b230e692b5d8714392a2b317d204b215dfe0914c42693f8e02982734fc"
        },
        {
            "path":  "package.json",
            "sha256":  "1a74a2e6df9c62075984d914fbcf2af3040e1bbba5967de3365ac3f23763ad64",
            "tlsh":  "75d05e3009109a73bcc40aa5183a908b29a10d1b4248b820b7d3116582db7ba68bb35e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "fr-ito-web-react-99.99.99.tgz",
            "hashes":  {
                "sha1":  "8cb36e5c7f3aa8504fdeb82bf46f66279befd26b",
                "sha512_sri":  "sha512-bSYpHnx/4i5sqklT5qHTKrX/qILGlptqniBuP5A0nwmZ7Rv3S/PhQSnggAJQqtQLhL9lB6KHx9cFkyvFNu/SnA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fr-ito-web-react/MAL-2026-14019.json"