MAL-2026-15589

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/autobahn-electron-probe/MAL-2026-15589.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15589
Published
2026-08-30T01:25:47Z
Modified
2026-08-31T18:31:22.348675869Z
Summary
Malicious code in autobahn-electron-probe (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b9a749e23bbf7c5ca871c797923855dc2c7fe1006c5843ed8a13292d7fbd4256)

package.json declares preinstall and postinstall lifecycle scripts that run curl against http://da9ohqqvbsgu1166tuu0rrroxsztr18dt.cyowl.com/autobahn-electron-probe/, sending the installer's username (whoami), hostname, current working directory, and a timestamp as query parameters over plain HTTP. The long unique subdomain under cyowl.com is a DNS-callback / OAST-style exfiltration pattern. The scripts fire automatically on npm install without any user action, and the package ships no functional module code — the lifecycle beacon is the entire payload. The package name resembles the Autobahn WebSocket project and Electron, but the shipped contents perform only host reconnaissance and beaconing.

Source: ossf-package-analysis (d3c07ff64c9729469df8453fb5fd6fa15e1099e81916496d741fe10297e44fc7)

The OpenSSF Package Analysis project identified 'autobahn-electron-probe' @ 99.99.1 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-30T23:14:56.177874547Z",
            "source": "ossf-package-analysis",
            "versions": [
                "99.99.1"
            ],
            "modified_time": "2026-08-30T01:25:47Z",
            "sha256": "d3c07ff64c9729469df8453fb5fd6fa15e1099e81916496d741fe10297e44fc7"
        },
        {
            "import_time": "2026-08-31T17:16:14.386846818Z",
            "source": "amazon-inspector",
            "versions": [
                "99.99.1"
            ],
            "id": "IN-MAL-2026-019175",
            "modified_time": "2026-08-31T16:49:18Z",
            "sha256": "12dc0a5dd6ee92d1530068fa541791305711fad5f9b206ebee22b22f164692a5"
        },
        {
            "import_time": "2026-08-31T18:22:30.099751588Z",
            "source": "amazon-inspector",
            "versions": [
                "99.99.2"
            ],
            "id": "IN-MAL-2026-019316",
            "modified_time": "2026-08-31T18:04:07Z",
            "sha256": "44facef09636d88a5a2b6c5ebd5313bcc3282654125320ff922fac9bd1051c89"
        },
        {
            "import_time": "2026-08-31T18:22:29.89482128Z",
            "source": "amazon-inspector",
            "versions": [
                "99.99.3"
            ],
            "id": "IN-MAL-2026-019313",
            "modified_time": "2026-08-31T18:03:40Z",
            "sha256": "b9a749e23bbf7c5ca871c797923855dc2c7fe1006c5843ed8a13292d7fbd4256"
        }
    ]
}
References
Credits

Affected packages

npm / autobahn-electron-probe

Package

Name
autobahn-electron-probe
View open source insights on deps.dev
Purl
pkg:npm/autobahn-electron-probe

Affected ranges

Affected versions

99.*
99.99.1
99.99.2
99.99.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/autobahn-electron-probe/MAL-2026-15589.json"
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "2ef04664f42268b33dc58f695cc0c60b39301d4b0318a602464bec082bed26757ba21b",
            "sha256": "96594d73700eb0e763fb127749be327a2b583dcacaa7dc07db6785bc4ba7049f"
        }
    ],
    "package_integrity": [
        {
            "filename": "autobahn-electron-probe-99.99.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-mSowWvbhkU0RiUYGesXFIXyoFrVd+EzVcSVrQpfaajYFltJzY/hGHBfWzleUCrm98RAlEZj3KQ+T1MUs+dIs9A==",
                "sha1": "65123691e8570f9a9084e48ce2015306ea4b9ccb"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]