MAL-2026-14381

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fund-portfolio/MAL-2026-14381.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14381
Published
2026-08-23T11:00:52Z
Modified
2026-08-24T05:30:14.689321813Z
Summary
Malicious code in fund-portfolio (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17)

Package declares scripts.preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, username, home directory, INIT_CWD, local IPv4, public egress IP (via api.ipify.org, icanhazip.com, ifconfig.me), DNS resolver IP and client subnet (via o-o.myaddr.l.google.com), and the parent project's package.json fields (name, author, repository, homepage). The collected JSON is exfiltrated to the hardcoded callback host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun (Interactsh/OAST) via DNS-chunked queries and HTTPS POST to /poc/<uuid>. The unscoped name is published at version 999.9.12 to defeat internal resolvers that fall back to the public npm registry, so any build referencing fund-portfolio without a private-registry pin will resolve to and execute this payload.

Source: ossf-package-analysis (ffad2f6c37441c2924e67b1d506d9c26dc9cb2fae325b74a596102ea5ed403bf)

The OpenSSF Package Analysis project identified 'fund-portfolio' @ 999.9.12 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-23T11:00:52Z",
            "versions": [
                "999.9.12"
            ],
            "source": "ossf-package-analysis",
            "import_time": "2026-08-23T11:09:11.011429279Z",
            "sha256": "ffad2f6c37441c2924e67b1d506d9c26dc9cb2fae325b74a596102ea5ed403bf"
        },
        {
            "sha256": "27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17",
            "modified_time": "2026-08-24T05:04:31Z",
            "versions": [
                "999.9.12"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018589",
            "import_time": "2026-08-24T05:20:12.455986364Z"
        }
    ]
}
References
Credits

Affected packages

npm / fund-portfolio

Package

Name
fund-portfolio
View open source insights on deps.dev
Purl
pkg:npm/fund-portfolio

Affected ranges

Affected versions

999.*
999.9.12

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fund-portfolio/MAL-2026-14381.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "36c2fc4a3aa31382ee5b6bc83308f8ee918c34d4d7abe512a45e67fb9e5e2557",
            "tlsh": "19e1b75712fa203012623ab8279f58957333d523338aebd0b98d03645fd727d53b26da"
        },
        {
            "path": "README.md",
            "sha256": "4135538edb5543ca2e841d648b105f0a6fb387b32eaecb1f84e3cc1e5857e9bd",
            "tlsh": "da51d8ab4791133154a249b2915d7add4773c078602a4cd0a0aee30da6637a8473e1ea"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "c539fd6223590b833056a21b43bbb8fe73040eb6",
                "sha512_sri": "sha512-j2x1u6jKBOJcYkXTTfooQxQoX9kmtXnEZSI1WxFklJvKcafKTXPdXHJziWJsdGWGUSf5riOwCA4yBPfxM4Bojg=="
            },
            "filename": "fund-portfolio-999.9.12.tgz"
        }
    ]
}