MAL-2026-14526

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/omniauth-recharge-rails-example/MAL-2026-14526.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14526
Published
2026-08-26T07:50:58Z
Modified
2026-08-26T14:30:12.525300985Z
Summary
Malicious code in omniauth-recharge-rails-example (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7)

The package's package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL (https://webhook.site/26e65e9b-fd9c-4f3f-beb3-063309f4d7d9/) with query parameters carrying $(whoami), $(pwd), and $(hostname) from the installer's machine. The request fires automatically on npm install, transmitting the installer's username, working directory path, and hostname to a third-party collector controlled by whoever provisioned the webhook token. This is the canonical dependency-confusion / namespace-squat beacon pattern used to prove reachability into an internal network by leaking host identity.

Source: ossf-package-analysis (915a378563ab8481e64d0a202e4d037a722361eae5263812c7648dce30cc557e)

The OpenSSF Package Analysis project identified 'omniauth-recharge-rails-example' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "source": "ossf-package-analysis",
            "sha256": "915a378563ab8481e64d0a202e4d037a722361eae5263812c7648dce30cc557e",
            "import_time": "2026-08-26T09:20:19.714790383Z",
            "modified_time": "2026-08-26T07:50:58Z"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7",
            "id": "IN-MAL-2026-018745",
            "import_time": "2026-08-26T14:20:36.647489953Z",
            "modified_time": "2026-08-26T14:08:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / omniauth-recharge-rails-example

Package

Name
omniauth-recharge-rails-example
View open source insights on deps.dev
Purl
pkg:npm/omniauth-recharge-rails-example

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "13180ec6b8bf839d6a856b60a9d7920a7fc8e904f5ef81d5f8f78373aa094b52",
            "tlsh": "50019934b2246a631ac94fb10125052ba536faa781116c2ceba7225d936e9e2407c988"
        }
    ],
    "package_integrity": [
        {
            "filename": "omniauth-recharge-rails-example-1.0.0.tgz",
            "hashes": {
                "sha1": "6f01bd5e6246f9bc475d8e3accfc8c8047bc9cb9",
                "sha512_sri": "sha512-0FgoKHIy2Nm3jpMyh4l/gJQxawrZevDsZ4g8Km3CEMJR4tzmg8VXUydaacrOHXc2ffiO2241XNmr7pT/+a3dOA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/omniauth-recharge-rails-example/MAL-2026-14526.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]