MAL-2026-14237

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gaarf-bq/MAL-2026-14237.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14237
Published
2026-08-19T03:48:25Z
Modified
2026-08-19T04:00:16.908651786Z
Summary
Malicious code in gaarf-bq (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0)

On npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and POSTs them to a hardcoded endpoint at vpx0x956.instances.poc.jchunt.top (path /gaarf-bq) via https.request. The destination is not caller-configurable and is not related to any documented purpose of the package. The package name resembles Google's ads-api-report-fetcher (gaarf) BigQuery component, consistent with dependency-confusion scaffolding that lures internal builds into resolving this public name and beaconing back host fingerprints. A self-description as a security-research canary does not change the observed behavior: installer-owned identifiers leave the machine to an author-controlled host without opt-in.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:49:31.048642106Z",
            "sha256": "841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0",
            "modified_time": "2026-08-19T03:48:25Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018338",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gaarf-bq

Package

Name
gaarf-bq
View open source insights on deps.dev
Purl
pkg:npm/gaarf-bq

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gaarf-bq/MAL-2026-14237.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "17d68acc5a2cfeb9b7b80d337da5f33611463335234aeca36ff3bbddf52accb1",
            "tlsh": "8401d3d5d1b95a7557f8629068f0af0693fbf223370624b67ac454e92f8d1f5003119d",
            "path": "postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "gaarf-bq-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-ydFpDxt5v8cEZ3DkYDHdpNAFlgmxuGnmfh5sO5FAbFIE9GwlldLutw100KukRmSUCzj4UPjCuukXS5Z6hwUfJg==",
                "sha1": "ba8af3ee332f063283de570669d16e8947d5b3cf"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]