MAL-2026-14591

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cacao1/MAL-2026-14591.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14591
Published
2026-08-28T12:25:44Z
Modified
2026-08-28T19:45:33.135283494Z
Summary
Malicious code in cacao1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8)

The package has no advertised functionality (empty description, self-referential dependency on its own name at ^9.9.9). Its package.json declares both preinstall and postinstall lifecycle scripts that execute index.js, which reads os.hostname() and issues an HTTP GET to https://eo8f3m3ho26a0nm.m.pipedream.net/cacao1 with the hostname included as a query parameter. Installing the package therefore causes the installer's hostname to be transmitted to a hardcoded third-party collector controlled by the package author. The structure (empty description, self-dependency, lifecycle-triggered beacon to a pipedream.net collector, unusual 9.9.9 version) matches a dependency-confusion beacon rather than a functional library.

Source: ossf-package-analysis (7e80e85bc2ce7bba9bc4f288f4757cb9921d0fc4d7635c0a07ba35d19382df79)

The OpenSSF Package Analysis project identified 'cacao1' @ 9.9.9 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "import_time": "2026-08-28T15:05:27.151059052Z",
            "modified_time": "2026-08-28T12:25:44Z",
            "sha256": "7e80e85bc2ce7bba9bc4f288f4757cb9921d0fc4d7635c0a07ba35d19382df79",
            "versions": [
                "9.9.9"
            ]
        },
        {
            "id": "IN-MAL-2026-018817",
            "modified_time": "2026-08-28T17:06:10Z",
            "import_time": "2026-08-28T19:33:50.794736103Z",
            "source": "amazon-inspector",
            "sha256": "403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8",
            "versions": [
                "9.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cacao1

Package

Name
cacao1
View open source insights on deps.dev
Purl
pkg:npm/cacao1

Affected ranges

Affected versions

9.*
9.9.9

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "cacao1-9.9.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-eUR4PfTF/1RZXFBakOUWLNe0OYcFAoOJ9ZGajiIQqXGTb/rFZZtRM+myxxmusbkI2hzswmEOg6BFsm8ohBho1Q==",
                "sha1": "35a0eb3acb366f58dd36e81d8c911f41ec37bdd6"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "3dd012d30be9b264b6808d8194625b0b775be10732b8c5b4d04e87daddd29e10933ce0",
            "sha256": "95beb1ce62037661b6c609349821059cafe717dc0e67428c03fce95c6531f1e6"
        },
        {
            "path": "package.json",
            "tlsh": "cce0eda2cc509b6310fc16e868791b07f1621f2f126c4c4f34f3b08caaa2133009eb2a",
            "sha256": "3472fbebfba6145c8c850501ce6a2d97eed81267af83dc2b07203c5226b43c68"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cacao1/MAL-2026-14591.json"