MAL-2026-15549

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ckeditor5-ckbox/MAL-2026-15549.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15549
Published
2026-08-29T02:15:04Z
Modified
2026-08-29T02:30:12.882136086Z
Summary
Malicious code in ckeditor5-ckbox (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7)

Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook (node index.js) that runs on npm install. index.js collects installer machine identifiers — os.hostname(), os.userInfo() (username, uid, gid, shell), platform/arch, home directory, cwd, and the output of whoami and id executed via child_process — and POSTs the JSON to the hardcoded Burp Collaborator OAST domain https://shdu19bid9mc4e6lezjmldk0erki88wx.oastify.com/system-info. The package contains no CKEditor functionality; the sole payload is the install-time beacon. Author/description are empty and the name is a typosquat of the scoped legitimate package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019147",
            "source": "amazon-inspector",
            "import_time": "2026-08-29T02:22:21.681581921Z",
            "modified_time": "2026-08-29T02:15:04Z",
            "sha256": "9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7",
            "versions": [
                "5.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ckeditor5-ckbox

Package

Name
ckeditor5-ckbox
View open source insights on deps.dev
Purl
pkg:npm/ckeditor5-ckbox

Affected ranges

Affected versions

5.*
5.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "ckeditor5-ckbox-5.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-x2znUEEf7uzHBgNLZMfxVOo7gm6nLusyV2jaXtkzmN7mQWoPWxn9ubcJfcln3BdZ63i2O2l2KL9SN2Ukqzw73g==",
                "sha1": "e069ddf549893986b518e601ac14465b19373b55"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "b5513fc516f65a251ba7a8494a0f9402a327e0033549ee55bfcc8740af9936c9bf0bf6",
            "sha256": "dabe680d43c5cbf486d25209f227743df93b5f7e891251d220fe918c9f999d0b"
        },
        {
            "path": "package.json",
            "tlsh": "aed02e300d21582325d00692086eb04262a08f2f1a043808a3cb283ca0ef6b3acff30d",
            "sha256": "04c4ecd2cea2132b3b2fc181d00c67dbf32b7ad76734c5f12409ad2f3882221c"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ckeditor5-ckbox/MAL-2026-15549.json"