MAL-2026-14377

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stillm4ddpocs-rtest-alpha/MAL-2026-14377.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14377
Published
2026-08-23T03:13:15Z
Modified
2026-08-23T03:30:25.107194483Z
Summary
Malicious code in stillm4ddpocs-rtest-alpha (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839)

package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP (via https://api.ipify.org, https://icanhazip.com, https://ifconfig.me), DNS-resolver IP, hostname, OS username, home directory, cwd, and the parent project's package.json name/author/repository/homepage, then transmits the JSON to the hardcoded callback da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun via three channels: HTTP POST on:80, HTTPS POST on:443, and DNS TXT queries whose labels carry the hex-encoded payload split into 60-character chunks. The DNS covert channel and hex chunking are structured to bypass egress filtering that blocks outbound HTTP. The package's self-description as 'authorised security research' does not gate execution; any project that resolves this name at install time transmits the data without consent. The 999.9.9 version and lure name are consistent with a dependency-confusion probe.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-23T03:13:15Z",
            "versions": [
                "999.9.10"
            ],
            "sha256": "1838ad5b8199e05fbd2be46a4eeba578cbe40cf798b243fbc378e4ec4a84a8d9",
            "id": "IN-MAL-2026-018559",
            "import_time": "2026-08-23T03:25:55.266989026Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-23T03:13:29Z",
            "versions": [
                "999.9.9"
            ],
            "sha256": "47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839",
            "id": "IN-MAL-2026-018561",
            "import_time": "2026-08-23T03:25:55.452191892Z"
        }
    ]
}
References
Credits

Affected packages

npm / stillm4ddpocs-rtest-alpha

Package

Name
stillm4ddpocs-rtest-alpha
View open source insights on deps.dev
Purl
pkg:npm/stillm4ddpocs-rtest-alpha

Affected ranges

Affected versions

999.*
999.9.9
999.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stillm4ddpocs-rtest-alpha/MAL-2026-14377.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "42cf30097f9b9c76569c50f4c64dad915fdd3e45b60beddb3d3e3f154d1496e1",
            "tlsh": "a6e1a59712fa203012623aa8279f58957333d523338aebd0b98d43645fd727d53b26da"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "cbeaea674c33a96e0a1f5db8ba8553c8d363919f",
                "sha512_sri": "sha512-spxl1hhKYLkwpYY/fIQWr9vpqoayntptLdx2TYTTfVmRDGL7uquzeBpvCaDGuL8e7ZV3kLStqc0spXV3IyjTmA=="
            },
            "filename": "stillm4ddpocs-rtest-alpha-999.9.10.tgz"
        }
    ]
}