MAL-2026-14437

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ppb-manticore/MAL-2026-14437.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14437
Published
2026-08-24T16:39:35Z
Modified
2026-08-24T17:00:14Z
Summary
Malicious code in ppb-manticore (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422)

On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward through parent directories to read the enclosing project's package.json (name, author, version), hex-encodes the aggregated JSON, splits it into 60-character DNS labels with a sequence prefix, and issues dns.lookup() queries to the hardcoded nameserver da5u87oh92rc72pp1dngqfc6hp8gwshm6.o.jgl.red. The channel uses DNS rather than HTTP, evading HTTP/proxy egress controls, and fires automatically without user interaction. A source comment framing the behavior as bug-bounty or dependency-confusion research does not alter the mechanism: installer-side identity and enclosing-project identifiers are transmitted to a third-party author-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018632",
            "import_time": "2026-08-24T16:49:13.665453882Z",
            "modified_time": "2026-08-24T16:39:35Z",
            "sha256": "2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422",
            "source": "amazon-inspector",
            "versions": [
                "9.4.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ppb-manticore

Package

Name
ppb-manticore
View open source insights on deps.dev
Purl
pkg:npm/ppb-manticore

Affected ranges

Affected versions

9.*
9.4.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "c835ace1cc4d6056105fbcfa10782f6e15e308e0548b2343c0cb9d71735ef4dc",
            "tlsh": "b341ac9fdce70074b826223a9bbf441532d7d3333511ded1b45ce6805fe246826d69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "ppb-manticore-9.4.3.tgz",
            "hashes": {
                "sha1": "bae2ca261e9ccbff8b7da01fff6105a42a606ee2",
                "sha512_sri": "sha512-Rm5x2R1G6xKAYlC3ex5g8kUVfOM5fbjzrdMgHBhgjsf6Hn++eDhHhYq3g35Uk7ZwmWM72g0Zc5UURoYhQdn8rQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ppb-manticore/MAL-2026-14437.json"