MAL-2026-14387

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@opap/player-kyc-widget/MAL-2026-14387.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14387
Aliases
  • GHSA-356g-cp7r-g5f5
Published
2026-08-23T20:00:33Z
Modified
2026-09-08T00:30:14Z
Summary
Malicious code in @opap/player-kyc-widget (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc)

The package's postinstall script runs automatically on npm install and collects host identifiers (hostname, username, cwd, platform, arch) from the installer, then transmits them off-host through two channels to a hardcoded Burp Collaborator subdomain k5qrs9i96xtw61nb3bbwwualqcw3kt8i.oastify.com: (1) an HTTPS GET carrying a base64-encoded payload in the query string, and (2) a DNS lookup where the fingerprint is hex-encoded and split into <=60-char labels prepended to the callback host, providing a covert channel that works even when outbound HTTP egress is blocked. The version number 3.999.999 published to the public @opap scope is the canonical shape of a dependency-confusion attack targeting a private internal scope of the same name.

Source: ghsa-malware (ebbe49c2623d54fed28386f226aefa5f14ccdf94caee07543ae5251beffd13fc)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source: ossf-package-analysis (98e627cea85331a67652aa65927058579efe7046253a9ef22cb70b1d73916885)

The OpenSSF Package Analysis project identified '@opap/player-kyc-widget' @ 3.999.999 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-23T20:07:45.140609589Z",
            "modified_time": "2026-08-23T20:00:33Z",
            "sha256": "98e627cea85331a67652aa65927058579efe7046253a9ef22cb70b1d73916885",
            "source": "ossf-package-analysis",
            "versions": [
                "3.999.999"
            ]
        },
        {
            "id": "IN-MAL-2026-018590",
            "import_time": "2026-08-24T05:20:12.557261485Z",
            "modified_time": "2026-08-24T05:04:38Z",
            "sha256": "abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc",
            "source": "amazon-inspector",
            "versions": [
                "3.999.999"
            ]
        },
        {
            "id": "GHSA-356g-cp7r-g5f5",
            "import_time": "2026-09-08T00:15:09.966118857Z",
            "modified_time": "2026-09-07T16:37:51Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "ebbe49c2623d54fed28386f226aefa5f14ccdf94caee07543ae5251beffd13fc",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / @opap/player-kyc-widget

Package

Name
@opap/player-kyc-widget
View open source insights on deps.dev
Purl
pkg:npm/%40opap/player-kyc-widget

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.999.999

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "dda4845548db484e4c259831fa9d6f90f4d0d03dd19fb4f50c294428fd81c237",
            "tlsh": "d731576611f0223015ea34d0434b1199576be25b5b65f9d4f54e03085f8aab487725fa"
        }
    ],
    "package_integrity": [
        {
            "filename": "player-kyc-widget-3.999.999.tgz",
            "hashes": {
                "sha1": "f8bc01f36e529b94d91009b1339a6fb311159b50",
                "sha512_sri": "sha512-CiEVyweEy7rqSL3Q7EuedoYv8Ltao+IViHjp3/e4U7AU8gRf9DD2TFf0cw9EXsylaTlZoMUvSnFVCIwM25icSA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@opap/player-kyc-widget/MAL-2026-14387.json"