MAL-2026-14390

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amundi-compare/MAL-2026-14390.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14390
Published
2026-08-24T05:06:33Z
Modified
2026-08-24T05:30:14Z
Summary
Malicious code in amundi-compare (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0bc0f77ca83947d2af9978911d3a4da11af6a6a4773268f662291180c27b6f38)

amundi-compare@999.9.12 is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The package.json declares a preinstall hook (node index.js) that runs automatically on npm install. index.js collects hostname, OS user, home directory, current working directory, local IPv4 addresses, public egress IP (queried from api.ipify.org, icanhazip.com, and ifconfig.me), the DNS resolver IP and client subnet, and the parent project's package.json name/author/repository/homepage fields. The payload is transmitted through three parallel channels to the hardcoded callback host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun: an HTTP POST, an HTTPS POST to /poc/, and a DNS covert channel that hex-encodes the JSON, splits it into <=60-character chunks, and emits each chunk as a subdomain label under the callback domain. The DNS channel is designed to bypass egress filters that block outbound HTTP. The package labels itself as authorized security research, but the callback host is not installer-configured and the parent project's metadata is captured without consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018603",
            "import_time": "2026-08-24T05:20:13.809595932Z",
            "modified_time": "2026-08-24T05:06:33Z",
            "sha256": "0bc0f77ca83947d2af9978911d3a4da11af6a6a4773268f662291180c27b6f38",
            "source": "amazon-inspector",
            "versions": [
                "999.9.12"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / amundi-compare

Package

Name
amundi-compare
View open source insights on deps.dev
Purl
pkg:npm/amundi-compare

Affected ranges

Affected versions

999.*
999.9.12

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "b878a7f6c2ffb7cc5df10d605ce18f6cb4d21b0b13b97ada5310823223fbe845",
            "tlsh": "2be1b69712fa203012623ab8279f58957333d523338aebd0b98d43645fd727d53b26da"
        }
    ],
    "package_integrity": [
        {
            "filename": "amundi-compare-999.9.12.tgz",
            "hashes": {
                "sha1": "c8805d2fcb027258655e06c90a575b46bb70d4ae",
                "sha512_sri": "sha512-0SpDdFNEtOcuHaDvA7gGeXo5nWtp4Rqs0yMbcX5UrLq3VTo7SMG5XxG4TnIbuiwg+zNId5n2+rXF11kC0cQ8cw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amundi-compare/MAL-2026-14390.json"