MAL-2026-14245

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/github-policy-bot/MAL-2026-14245.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14245
Published
2026-08-19T03:52:07Z
Modified
2026-08-19T04:30:12.348697205Z
Summary
Malicious code in github-policy-bot (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132)

On npm install, the package's postinstall script collects host identifiers (os.hostname(), platform, arch, node version, package name, npm lifecycle event) and POSTs them as JSON to the hardcoded host vlfl47tl.instances.poc.jchunt.top at path /github-policy-bot. The outbound request is fail-silent (error handler swallows failures) and short-timeout, consistent with a beacon. The package name shadows the Google-owned js-github-policy-bot repository path referenced in the tarball's source.txt, and the package.json author is a placeholder (r00tdaddy) with a self-declared 'security research canary' purpose — an author-controlled label that does not change the behavior. Installing this package causes unsolicited disclosure of the installer's hostname and environment metadata to a third-party endpoint the installer did not configure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:18:13.578421427Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T03:52:07Z",
            "sha256": "87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132",
            "id": "IN-MAL-2026-018342",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / github-policy-bot

Package

Name
github-policy-bot
View open source insights on deps.dev
Purl
pkg:npm/github-policy-bot

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/github-policy-bot/MAL-2026-14245.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "1f39c16726c49952d82a48aa38d599c6d664e1e9f372f1b8b3e092cdaa88787a",
            "path": "postinstall.js",
            "tlsh": "6b019ed5d2b5567557b8628068e1af0693baf2233b0660b669c445a92fcd1f5003219d"
        },
        {
            "sha256": "188cf8944f9888a9a790607b74b91eb1f69900e5253b6941ba4e9b8340230509",
            "tlsh": "3eb022c22023c082cf0c2c3c088c0020b33b3008fca0a0f2c80a0f80e080cfc0a03308",
            "path": "source.txt"
        }
    ],
    "package_integrity": [
        {
            "filename": "github-policy-bot-1.0.0.tgz",
            "hashes": {
                "sha1": "0a5672a6b1d53b30f81cb5a9eefb6cece349aae6",
                "sha512_sri": "sha512-lbofepwkCdYTOfDmH4PnIjLWr8Pl4LwNBHfr0eJzQcSrgOKPq3ebFCcqjAd+tzcbYtd+vvgcnFm5FMs+Di3otQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]