MAL-2026-14059

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/autbank-core/MAL-2026-14059.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14059
Published
2026-08-15T15:44:10Z
Modified
2026-08-15T16:15:12.527528474Z
Summary
Malicious code in autbank-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d)

On npm install, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH, PRIVATE, NPM, GIT, GITHUB, GITLAB), reads the working directory's.env and package.json, runs git remote -v, and POSTs the collected data via https to a hardcoded webhook.site collector (https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2). A companion postinstall.js labeled internally as 'backup exfil' POSTs os.hostname(), os.userInfo().username, and process.cwd() to the same endpoint. Both lifecycle hooks fire automatically on default install, with no relationship to any advertised package functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017936",
            "import_time": "2026-08-15T16:07:54.80119972Z",
            "sha256": "4ad44010b651e1b239cfbe69c004f11d9227c483ffe55d549368afb4eb394146",
            "versions": [
                "99.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-15T15:44:10Z"
        },
        {
            "import_time": "2026-08-15T16:07:54.893866813Z",
            "id": "IN-MAL-2026-017937",
            "sha256": "8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d",
            "modified_time": "2026-08-15T15:44:21Z",
            "source": "amazon-inspector",
            "versions": [
                "99.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / autbank-core

Package

Name
autbank-core
View open source insights on deps.dev
Purl
pkg:npm/autbank-core

Affected ranges

Affected versions

99.*
99.0.0
99.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "913182f012f692b125e2b1d0895f1402172be2177915fae47ccc02291f8a9ac87b36f4",
            "sha256": "2a02edf029c4d1f2ee84304f4b3e9ffbcf038b83a577201d5ae405986d565c74"
        }
    ],
    "package_integrity": [
        {
            "filename": "autbank-core-99.0.0.tgz",
            "hashes": {
                "sha1": "f6522cd7bc0058ee3ce90f02c3b76710a389eed4",
                "sha512_sri": "sha512-dagmO5Ia+RVZs1h+qJmaw8xyRjAA0RgDPl+VFwsRou6+eGOqGKptv3GBqS3F+XaUYtVtL5cSMhhNPPfUzP/rzg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/autbank-core/MAL-2026-14059.json"