MAL-2026-15527

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aura-instrumentation/MAL-2026-15527.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15527
Published
2026-08-28T23:16:32Z
Modified
2026-08-28T23:45:12.598983835Z
Summary
Malicious code in aura-instrumentation (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd)

package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation rather than a registry version range. On npm install, npm fetches whatever tarball that host returns, unpinned and with no integrity check, and runs any lifecycle scripts inside it. The shipped source is an inert stub and a placeholder README, so the manifest line is the entire published surface: install-time code execution on the installer's machine is delegated to whoever controls repo.securityctrl.com. The self-referential dependency name and an implausibly high version (45.0.0) for an otherwise empty package are consistent with a dependency-confusion lure aimed at winning resolution against an internal package of the same name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019102",
            "sha256": "14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd",
            "import_time": "2026-08-28T23:38:05.620686439Z",
            "modified_time": "2026-08-28T23:16:32Z",
            "source": "amazon-inspector",
            "versions": [
                "45.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / aura-instrumentation

Package

Name
aura-instrumentation
View open source insights on deps.dev
Purl
pkg:npm/aura-instrumentation

Affected ranges

Affected versions

45.*
45.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "d4ae086ac3efc2eaedbfa6d421e87664c4181212",
                "sha512_sri": "sha512-Consmc3CCyAr1VZRFai4dbnv671zUmJL6PJ0fgLtwyCDczZDWCc+YxUL/Cv8hy+KAgwa9iGUEWVngEvqT4Claw=="
            },
            "filename": "aura-instrumentation-45.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "64e22262f56e763c9b56f256e0a27d26f5081f6792b7d58488a8721e4e106105",
            "tlsh": "c6e086b45d1216b71ec702532879886772614f5f28047c4666c7291c494a9b3a9fe35c",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aura-instrumentation/MAL-2026-15527.json"