MAL-2026-14378

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stillm4ddpocs-rtest-bravo/MAL-2026-14378.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14378
Published
2026-08-23T03:13:51Z
Modified
2026-08-23T03:30:25.253816724Z
Summary
Malicious code in stillm4ddpocs-rtest-bravo (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2)

package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hostname, username, home directory, local IPv4, INITCWD, and the public egress IP (queried from api.ipify.org, icanhazip.com, and ifconfig.me), and reads the consuming project's package.json (INITCWD/package.json) to extract name, author, repository, and homepage — identifying which internal package name resolved to this public package. The payload is transmitted to the hardcoded collector da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun via HTTPS POST to /poc/<uuid> and, in parallel, hex-encoded and chunked into DNS labels (<idx>-<chunk>.u-<uuid>.<callback>) resolved via dns.resolve, providing a fallback exfiltration channel when outbound HTTP is filtered. The package's self-description as a dependency-confusion research PoC does not change the behavior: installer host and parent-project identifiers are shipped to a third-party Interactsh collector without installer consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2",
            "modified_time": "2026-08-23T03:13:51Z",
            "versions": [
                "999.9.10"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018564",
            "import_time": "2026-08-23T03:25:55.728189159Z"
        },
        {
            "id": "IN-MAL-2026-018565",
            "modified_time": "2026-08-23T03:13:58Z",
            "versions": [
                "999.9.9"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-23T03:25:55.821554142Z",
            "sha256": "fd3e9cff049df53120f980d470f575d8723edc6a3ea29a09b78f7f9aedf4a006"
        }
    ]
}
References
Credits

Affected packages

npm / stillm4ddpocs-rtest-bravo

Package

Name
stillm4ddpocs-rtest-bravo
View open source insights on deps.dev
Purl
pkg:npm/stillm4ddpocs-rtest-bravo

Affected ranges

Affected versions

999.*
999.9.9
999.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stillm4ddpocs-rtest-bravo/MAL-2026-14378.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "b8bbccbb12bdcb2e4f40f0a44a2ae1d1d1c43e898351e23bf6542a4c6376418f",
            "tlsh": "2fe1a69712fa203012623ab8279f58957333d523338aebd0b98d43645fd727d53b26da"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "066c0c115cf1290f07f060a7ef49cbf7373adfb2",
                "sha512_sri": "sha512-N3mD6g3ixMFPYC4a+X3RnE8sgZxRpx+TSHIP4UeKOn5dJ7yluT+MjyY8MEvwvHqKzVcf6oZElhiq5nJSDqqe7A=="
            },
            "filename": "stillm4ddpocs-rtest-bravo-999.9.10.tgz"
        }
    ]
}