MAL-2026-14060

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fastly-vcl-language-client/MAL-2026-14060.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14060
Published
2026-08-15T15:57:38Z
Modified
2026-08-15T16:15:12.516455279Z
Summary
Malicious code in fastly-vcl-language-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649)

The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via api.ipify.org, reads os.hostname(), and collects CI runner environment variables (CI, GITHUBACTIONS, GITHUBWORKFLOW, GITHUBRUNID, GITHUBRUNNUMBER, GITHUBRUNATTEMPT) from process.env, then POSTs/GETs the collected data to a hardcoded https://webhook.site/3c201be4-c16d-4e0c-bf9c-ccc50faa8574 endpoint. It additionally performs a DNS lookup of ping-<hostname>.<oast-collaborator-domain> to exfiltrate the hostname via DNS out-of-band. The package ships no real functionality — its metadata describes it as a 'dependency test utility package' and its name resembles an internal Fastly tool, consistent with a dependency-confusion / recon probe targeting build systems that resolve internal package names against public npm.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017959",
            "import_time": "2026-08-15T16:07:56.659295273Z",
            "sha256": "2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649",
            "modified_time": "2026-08-15T15:57:38Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fastly-vcl-language-client

Package

Name
fastly-vcl-language-client
View open source insights on deps.dev
Purl
pkg:npm/fastly-vcl-language-client

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "vishu.js",
            "tlsh": "d931224db2f7965004f263c8561b951f715be1533329dd917a9c02521faad3882f3bdc",
            "sha256": "2010719c38b757732676ea9129b3bd2768e3a7d0f26cfc10e16f1979c277af83"
        },
        {
            "path": "package.json",
            "tlsh": "dce0c2344a11a63766c44a921e66904666648f6f11447c086bdb152c419f7b788bf31d",
            "sha256": "a32b3d3e4706124090ebcbbf65d6bbfe436ce263965c537baec981031b43455a"
        }
    ],
    "package_integrity": [
        {
            "filename": "fastly-vcl-language-client-1.0.0.tgz",
            "hashes": {
                "sha1": "accc0ae35477a4f8bef3a35b4cf1468e05d45a44",
                "sha512_sri": "sha512-vcjtIfaHVxbgEyFATqt5JojiT4SSCHBv6cJn2Pgzy/UgdUSX+DQTYWn7EqBxEVBh4CI4JcUYvi60u7Tjpq1T7g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fastly-vcl-language-client/MAL-2026-14060.json"