MAL-2026-14161

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sidp-kiosk/test-npm-snurkeburk-hackerone/MAL-2026-14161.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14161
Published
2026-08-19T00:00:33Z
Modified
2026-08-19T00:30:13Z
Summary
Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159)

The package's package.json declares a preinstall script that runs index.js automatically on npm install. index.js shells out via child_process.exec to collect the installer's hostname, current working directory, username, a package marker, and the machine's public IP (fetched via curl to ifconfig.me). The aggregated output is hex-encoded with xxd and split into DNS labels queried via nslookup against subdomains of snurkeburk.com, a DNS-tunnel exfiltration channel that bypasses egress HTTP filtering. Installing this package causes host identifiers and public IP to leave the machine to an attacker-controlled DNS namespace.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018260",
            "import_time": "2026-08-19T00:21:14.230170864Z",
            "modified_time": "2026-08-19T00:00:41Z",
            "sha256": "65e2ca95b5e61ad788c9aaa4d42446bb772cd5bbd71569ff8babafbeea75d2fa",
            "source": "amazon-inspector",
            "versions": [
                "2.999.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018259",
            "import_time": "2026-08-19T00:21:14.144470528Z",
            "modified_time": "2026-08-19T00:00:33Z",
            "sha256": "69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159",
            "source": "amazon-inspector",
            "versions": [
                "1.999.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @sidp-kiosk/test-npm-snurkeburk-hackerone

Package

Name
@sidp-kiosk/test-npm-snurkeburk-hackerone
View open source insights on deps.dev
Purl
pkg:npm/%40sidp-kiosk/test-npm-snurkeburk-hackerone

Affected ranges

Affected versions

1.*
1.999.0
2.*
2.999.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "d0833370b7fceaffb68cc816e7834ab3a58d7e21bf2ea49ab11688344be20740",
            "tlsh": "efe068a5f6aa553273e150819c15101b7ac36e672cb2dc21565a853e2284a8ea0689db"
        }
    ],
    "package_integrity": [
        {
            "filename": "test-npm-snurkeburk-hackerone-2.999.0.tgz",
            "hashes": {
                "sha1": "e95fa5bd46383bd4874304a09f71950512fef0a4",
                "sha512_sri": "sha512-b8WmbG8p8pfOTX2WuV6RjDB+d90bESSuE9MmBeDJoC30x5wAZnavnFM+/eaSbKi9blz96yDDEhMkTgwF7vT9dA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sidp-kiosk/test-npm-snurkeburk-hackerone/MAL-2026-14161.json"