MAL-2026-14192

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tfjs-inference/MAL-2026-14192.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14192
Published
2026-08-19T00:03:33Z
Modified
2026-08-19T00:30:15.932725238Z
Summary
Malicious code in tfjs-inference (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (52ebb387c7f1f9bb3e96df6f8006cabc9141ddd1da35a58bfc14b42f2f6864eb)

The package name typosquats TensorFlow.js and its npm postinstall lifecycle script collects installer host identifiers (hostname, platform, arch, Node.js version, package name) and POSTs them as JSON to the hardcoded third-party host zl2u2d1x.instances.poc.jchunt.top at path /tfjs-inference. The exfiltration fires automatically on npm install with no opt-in and no configuration. Internal comments self-label the package as a security research canary, but the destination is author-controlled and the installer receives no notice or consent prompt.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:14.49681312Z",
            "sha256": "52ebb387c7f1f9bb3e96df6f8006cabc9141ddd1da35a58bfc14b42f2f6864eb",
            "modified_time": "2026-08-19T00:03:33Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018263",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tfjs-inference

Package

Name
tfjs-inference
View open source insights on deps.dev
Purl
pkg:npm/tfjs-inference

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tfjs-inference/MAL-2026-14192.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "171d892f52c71ff9dfb75518424ab0eb80eab9ee0819dff88f721b2f734ce0bc",
            "tlsh": "a001fed5d1b55a7127b8a28068e06f0693fbf223370620b679c404a92f8d0f500321ad",
            "path": "postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "tfjs-inference-1.0.0.tgz",
            "hashes": {
                "sha1": "a63669a14bebd9365f16367b4a0691c5a95ec18e",
                "sha512_sri": "sha512-oD+uMyyvuRBKm2U5B+VZNfy3D7x7IaATOol/0mzWsxiP30z8ym/lvYrg0dw7aaCRWj5TA50PI1idShu+pIfpWQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]