MAL-2026-14392

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/message-compiler/MAL-2026-14392.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14392
Published
2026-08-24T05:08:27Z
Modified
2026-08-24T05:30:16.115340148Z
Summary
Malicious code in message-compiler (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417)

The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables (CI, GITHUBACTIONS, GITHUBWORKFLOW, GITHUBRUNID and related), and issues an HTTPS GET to a hardcoded webhook.site collector URL carrying those fields. It additionally performs a DNS lookup of a subdomain constructed from os.hostname() under a hardcoded oastify.com (Burp Collaborator) domain, exfiltrating the installer's hostname via DNS. The package name typosquats the scoped @intlify/message-compiler package and its only functional code is this beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417",
            "source": "amazon-inspector",
            "versions": [
                "9.2.0"
            ],
            "modified_time": "2026-08-24T05:08:27Z",
            "id": "IN-MAL-2026-018616",
            "import_time": "2026-08-24T05:20:15.051851437Z"
        }
    ]
}
References
Credits

Affected packages

npm / message-compiler

Package

Name
message-compiler
View open source insights on deps.dev
Purl
pkg:npm/message-compiler

Affected ranges

Affected versions

9.*
9.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/message-compiler/MAL-2026-14392.json"
indicators 
{
    "evidence_files": [
        {
            "path": "vishu.js",
            "sha256": "b5005ec0e3db205675c8b69ca8f97ac0dfa65431ff4123aa21025ffb644496fd",
            "tlsh": "3731424cb2f7821004f363c8161b941e715be1533325cd917a9c02521fbad3882e3bd8"
        },
        {
            "path": "package.json",
            "sha256": "ac069f13545c51cae363c007e4303766e71a657c1042e62c37d0760e933f1dfc",
            "tlsh": "b2d0c2344a11a62726c10a921d16504673a08f2f11443c096bdf142c414f7b798bf32e"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "1902dda6ee2f5bc429bac1924459618387ada58b",
                "sha512_sri": "sha512-ZsVDKU0BSpGf34fE9KWlkZZJ83zjVZkl8zgEsAPaco1jmkg/JL0/mzWQybf/05+fb77b0qlG59MUw1aWI5vm5Q=="
            },
            "filename": "message-compiler-9.2.0.tgz"
        }
    ]
}