MAL-2026-14067

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/upload-to-gcp/MAL-2026-14067.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14067
Published
2026-08-15T18:07:45Z
Modified
2026-08-15T18:15:11Z
Summary
Malicious code in upload-to-gcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590)

upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017973",
            "import_time": "2026-08-15T18:08:48.526886933Z",
            "modified_time": "2026-08-15T18:07:45Z",
            "sha256": "4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590",
            "source": "amazon-inspector",
            "versions": [
                "3.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / upload-to-gcp

Package

Name
upload-to-gcp
View open source insights on deps.dev
Purl
pkg:npm/upload-to-gcp

Affected ranges

Affected versions

3.*
3.2.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "6c942eeec0ceda9021dcfacc519e832a5ad856404a6d789c399b82d7157aa8ce",
            "tlsh": "f4019ed0d1b99b311bf45780a191a90782bbd163770a617a6bd805753f8d5f9003719d"
        }
    ],
    "package_integrity": [
        {
            "filename": "upload-to-gcp-3.2.1.tgz",
            "hashes": {
                "sha1": "c9ef295d9b5407590e224223e4edf09736286cf6",
                "sha512_sri": "sha512-NBwHVfjtsasfO0RDJaFnwuVjs8i4V0YrYeH6zYjo/T8SRuc9zKprxuYhmJhdM3BI9D1dIPMsqgXI4wwCTAjnCw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/upload-to-gcp/MAL-2026-14067.json"