MAL-2026-14019

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fr-ito-web-react/MAL-2026-14019.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14019
Published
2026-08-14T06:50:50Z
Modified
2026-08-14T14:46:34.686835253Z
Summary
Malicious code in fr-ito-web-react (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e)

Package's package.json declares both preinstall and postinstall lifecycle hooks that execute node exfil.js on npm install. exfil.js runs whoami and id via child_process.execSync and transmits the output to the hardcoded host d9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site over HTTPS POST with TLS verification disabled (rejectUnauthorized: false), with a DNS lookup fallback that encodes the whoami output as a hex subdomain of the same collector. The package uses version 99.99.99, a typical dependency-confusion cover version to force resolution over an internal package of the same name. Installer identity and host data leaves the machine to an attacker-controlled interactsh/OAST collector without user interaction.

Source: ossf-package-analysis (bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1)

The OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-14T07:36:27.928352726Z",
            "sha256": "bac76856f8825e8e433f56d508f0fdc44c9397a172c3cb1935e893de74aa03c1",
            "versions": [
                "99.99.99"
            ],
            "source": "ossf-package-analysis",
            "modified_time": "2026-08-14T06:50:50Z"
        },
        {
            "id": "IN-MAL-2026-017725",
            "import_time": "2026-08-14T14:28:03.194179008Z",
            "sha256": "1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e",
            "versions": [
                "99.99.99"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T13:49:08Z"
        }
    ]
}
References
Credits

Affected packages

npm / fr-ito-web-react

Package

Name
fr-ito-web-react
View open source insights on deps.dev
Purl
pkg:npm/fr-ito-web-react

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "exfil.js",
            "tlsh": "c32187fa41f5b230e692b5d8714392a2b317d204b215dfe0914c42693f8e02982734fc",
            "sha256": "222ebe92d681b64f7b56b3ffaf639e05418b9921743759fcc6aa9e37cf57ddf0"
        },
        {
            "path": "package.json",
            "tlsh": "75d05e3009109a73bcc40aa5183a908b29a10d1b4248b820b7d3116582db7ba68bb35e",
            "sha256": "1a74a2e6df9c62075984d914fbcf2af3040e1bbba5967de3365ac3f23763ad64"
        }
    ],
    "package_integrity": [
        {
            "filename": "fr-ito-web-react-99.99.99.tgz",
            "hashes": {
                "sha1": "8cb36e5c7f3aa8504fdeb82bf46f66279befd26b",
                "sha512_sri": "sha512-bSYpHnx/4i5sqklT5qHTKrX/qILGlptqniBuP5A0nwmZ7Rv3S/PhQSnggAJQqtQLhL9lB6KHx9cFkyvFNu/SnA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fr-ito-web-react/MAL-2026-14019.json"