MAL-2026-14205

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sarex-team/translator/MAL-2026-14205.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14205
Published
2026-08-19T02:31:24Z
Modified
2026-08-19T03:00:13.051789769Z
Summary
Malicious code in @sarex-team/translator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6)

The package's install lifecycle script (scripts.install="node index.js") automatically executes on npm install and loads lib/core.js. That module reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates them with a timestamp as subdomain labels, and issues a dns.resolve4 lookup against oob.sl4x0.xyz — encoding the installer's identity into a DNS query that reaches the attacker's authoritative nameserver. The destination domain, the module names ('os', 'dns', 'process'), and the accessor names ('userInfo', 'hostname', 'cwd') are reconstructed at runtime from char-code arrays in hex-named files (lib/b02e30.js, lib/6ad264.js), concealing the exfiltration path from casual review. The exfil domain sl4x0.xyz matches the package author's contact email (research@sl4x0.xyz), confirming the destination is author-controlled.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:20.777786174Z",
            "sha256": "0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6",
            "modified_time": "2026-08-19T02:31:24Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018290",
            "versions": [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @sarex-team/translator

Package

Name
@sarex-team/translator
View open source insights on deps.dev
Purl
pkg:npm/%40sarex-team/translator

Affected ranges

Affected versions

9.*
9.9.11

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sarex-team/translator/MAL-2026-14205.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96",
            "path": "lib/core.js"
        },
        {
            "sha256": "17a31d36ceec65eebee4cfb6feeea9d7a9b79750f8279172692d70d25a7863a8",
            "tlsh": "1ee068073313c94fa1880bfb7e0050a0aa1d8b58a21dc0d6f628678600af447d0c0632",
            "path": "lib/b02e30.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "translator-9.9.11.tgz",
            "hashes": {
                "sha1": "4872ede38a3aea80b1a44a6fab4b3b8be5c5b3b8",
                "sha512_sri": "sha512-vybHHXNG4gKoQm4WkjJBob0e7O92Fnn0XoUHXx7h4dKImFl0G7so1BlEPs//zxuPNzpb77P059VHEQfmmWWA0Q=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]