MAL-2026-14204

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sarex-team/sdk-js/MAL-2026-14204.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14204
Published
2026-08-19T02:31:33Z
Modified
2026-08-19T03:00:14.125338112Z
Summary
Malicious code in @sarex-team/sdk-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2)

Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a package tag and timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz — a DNS-tunneled beacon to an attacker-controlled out-of-band collector. The destination host oob.sl4x0.xyz and the Node API names (os, dns, userInfo, hostname, cwd, resolve4) are stored as hex byte arrays in lib/b02e30.js and lib/6ad264.js and reconstructed at runtime via String.fromCharCode to disguise the recon path. The beacon fires automatically on npm install and again on every require() of the package, with no user interaction required.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:20.904137811Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T02:31:33Z",
            "sha256": "3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2",
            "id": "IN-MAL-2026-018291",
            "versions": [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @sarex-team/sdk-js

Package

Name
@sarex-team/sdk-js
View open source insights on deps.dev
Purl
pkg:npm/%40sarex-team/sdk-js

Affected ranges

Affected versions

9.*
9.9.11

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sarex-team/sdk-js/MAL-2026-14204.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4",
            "path": "lib/core.js",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"
        },
        {
            "sha256": "901819b610885da0d093f873f1b55205aa448ca4741c4ef5de0300b3ad1a5d55",
            "tlsh": "9de068073303c94fa1880bfb7d0050a0aa0e8b58a21dc0eab528678900af443c0c0632",
            "path": "lib/b02e30.js"
        },
        {
            "sha256": "8f978b11e45f51711f1469342d36bfad446e8154e4bbd4d4c20649aae7d401df",
            "tlsh": "1d216a21de654c232ec82994ec692942f56248174d417c0973d6923ccfaf6af51ff61e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "sdk-js-9.9.11.tgz",
            "hashes": {
                "sha1": "2728031f8f6dab9f1e16f0419f59071cc7087e2e",
                "sha512_sri": "sha512-spwOOv0rZEaGd2IsO4BGrdgzl4RlRGTe7NLygdbK6NIvev8ghVVKVXZP0Zzs5HauWbc5PyOARGf+VT3gA7HnXA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]