MAL-2026-14428

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb-serverutils/MAL-2026-14428.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14428
Published
2026-08-24T16:45:46Z
Modified
2026-08-24T17:00:15.369819030Z
Summary
Malicious code in consumerweb-serverutils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349)

consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working directory, walks up the directory tree to read the enclosing project's package.json (name, author, version), hex-encodes the aggregated JSON, splits it into 60-character chunks, and exfiltrates it as DNS label queries to the attacker-controlled zone o.jgl.red (observed subdomain da5u87oh92rc72pp1dngqfc6hp8gwshm6.o.jgl.red). A fallback dns.lookup using the hostname is issued on error. Use of DNS as the transport bypasses HTTP egress controls and covers the payload on the wire, and the parent-package walk enables dependency-confusion targeting of the installer's private/internal package names.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-24T16:45:46Z",
            "versions": [
                "3.4.3"
            ],
            "sha256": "04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349",
            "id": "IN-MAL-2026-018648",
            "import_time": "2026-08-24T16:49:14.824014215Z"
        }
    ]
}
References
Credits

Affected packages

npm / consumerweb-serverutils

Package

Name
consumerweb-serverutils
View open source insights on deps.dev
Purl
pkg:npm/consumerweb-serverutils

Affected ranges

Affected versions

3.*
3.4.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb-serverutils/MAL-2026-14428.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "f63c0c3018618794130b0ac5b8328422b3075255d9abbcfca9de77b07ec0ec33",
            "tlsh": "5941cc9fdce70074b826223a9b7f441532e7d3333511ded1b45ce6801fe246826c6ae9"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "16e9855d736b056551a20cc0f5af5661075fd5a5",
                "sha512_sri": "sha512-bUYObM/wB3uuFaFnhQBDv5x33F9LmOyhHi3YuvvV/IyraL4X/7Br+wWUMi6jv/QD0D4e+adz6AqxRwmnkbi/WA=="
            },
            "filename": "consumerweb-serverutils-3.4.3.tgz"
        }
    ]
}