MAL-2026-14262

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pump-fun-skills/MAL-2026-14262.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14262
Published
2026-08-19T05:15:14Z
Modified
2026-08-19T06:00:10.805650336Z
Summary
Malicious code in pump-fun-skills (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e)

The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching pump.fun and padre.gg, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T05:44:45.13493052Z",
            "sha256": "5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e",
            "modified_time": "2026-08-19T05:15:14Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018375",
            "versions": [
                "20.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / pump-fun-skills

Package

Name
pump-fun-skills
View open source insights on deps.dev
Purl
pkg:npm/pump-fun-skills

Affected ranges

Affected versions

20.*
20.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pump-fun-skills/MAL-2026-14262.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "b1976aad17b64032efa5f2d7b0c2f14dfd34be862836e34bde88778d961b5ee4",
            "path": "index.js",
            "tlsh": "47611ee481ba123136b3e5e111170003bdb2e1733216eef036cc8a991f5bb2852a78ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "pump-fun-skills-20.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-AICU6rduPIefuSUlDyYR9wIAplnjmQwLT7CLeRn2BfNd2epZ7Q8+GKP3qFjsbdXAYBqMSqy4bMAK5aWGykjMwA==",
                "sha1": "497e4226ee930a7fb0129e7ed28178db0503f00a"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]