MAL-2026-14067

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/upload-to-gcp/MAL-2026-14067.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14067
Published
2026-08-15T18:07:45Z
Modified
2026-08-15T18:15:11Z
Summary
Malicious code in upload-to-gcp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590)

upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-017973",
            "import_time":  "2026-08-15T18:08:48.526886933Z",
            "modified_time":  "2026-08-15T18:07:45Z",
            "sha256":  "4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590",
            "source":  "amazon-inspector",
            "versions":  [
                "3.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / upload-to-gcp

Package

Name
upload-to-gcp
View open source insights on deps.dev
Purl
pkg:npm/upload-to-gcp

Affected ranges

Affected versions

3.*
3.2.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "postinstall.js",
            "sha256":  "6c942eeec0ceda9021dcfacc519e832a5ad856404a6d789c399b82d7157aa8ce",
            "tlsh":  "f4019ed0d1b99b311bf45780a191a90782bbd163770a617a6bd805753f8d5f9003719d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "upload-to-gcp-3.2.1.tgz",
            "hashes":  {
                "sha1":  "c9ef295d9b5407590e224223e4edf09736286cf6",
                "sha512_sri":  "sha512-NBwHVfjtsasfO0RDJaFnwuVjs8i4V0YrYeH6zYjo/T8SRuc9zKprxuYhmJhdM3BI9D1dIPMsqgXI4wwCTAjnCw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/upload-to-gcp/MAL-2026-14067.json"