MAL-2026-14239

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gaarf-node-bq/MAL-2026-14239.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14239
Published
2026-08-19T03:48:45Z
Modified
2026-08-19T04:00:16.959905438Z
Summary
Malicious code in gaarf-node-bq (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633)

gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher (gaarf) package. The bin entry is an empty noop and the package ships no real functionality. Its postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, node version, package name, npm lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://yu7pug2j.instances.poc.jchunt.top/gaarf-node-bq. Any installer that mis-resolves the private name to the public registry has its host metadata sent to that endpoint without consent at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:49:31.139999681Z",
            "sha256": "1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633",
            "modified_time": "2026-08-19T03:48:45Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018340",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gaarf-node-bq

Package

Name
gaarf-node-bq
View open source insights on deps.dev
Purl
pkg:npm/gaarf-node-bq

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gaarf-node-bq/MAL-2026-14239.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "07d63284a6d4ccbf9da384f0d89af2a96e5fffaa840fe178262ce0582d48b13d",
            "tlsh": "fb0123d1d1b5567527f8628028f0af0793fbf223370624b679c444e92f8d4f9403119c",
            "path": "postinstall.js"
        },
        {
            "sha256": "d82398aee4b983232984133606db31c08bba1c50ab487af74ebdfb1c3a45a7c1",
            "path": "source.txt",
            "tlsh": "83b0127a208dd2330e10aabf57b8a164b81a6560bc70f9dd95198bd8730a464c2a7046"
        }
    ],
    "package_integrity": [
        {
            "filename": "gaarf-node-bq-1.0.0.tgz",
            "hashes": {
                "sha1": "6d1d2d5a7ea1aa1284b92924aebcb63cdf00eef8",
                "sha512_sri": "sha512-fqiv/zVIX8qx9gnYV/EJY71/yyol8UwfFJ3N5sAyHCqWXeh7FG45z1fOJfJSmMF2YOzTSV8wtE1uuZNo/00l5g=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]