MAL-2026-15590

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.db.autobahn.notification-center-electron/MAL-2026-15590.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15590
Published
2026-08-30T02:04:57Z
Modified
2026-08-31T18:31:22Z
Summary
Malicious code in com.db.autobahn.notification-center-electron (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452)

package.json declares preinstall and postinstall lifecycle scripts that automatically run curl on npm install to send installer identity (whoami, hostname, $PWD, timestamp) as query-string parameters to a long-random-label third-party host (da9nfhavbsgte1dqq8fgrbb7fyfekc37i.cyowl.com) over plain HTTP. The package name (com.db.autobahn.notification-center-electron) and implausibly high version (88.88.1) are consistent with a dependency-confusion lure targeting an internal scope; installing this package leaks host reconnaissance data to an external endpoint.

Source: ossf-package-analysis (fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807)

The OpenSSF Package Analysis project identified 'com.db.autobahn.notification-center-electron' @ 88.88.2 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-08-30T23:14:56.250461164Z",
            "modified_time":  "2026-08-30T02:04:57Z",
            "sha256":  "fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807",
            "source":  "ossf-package-analysis",
            "versions":  [
                "88.88.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-019173",
            "import_time":  "2026-08-31T17:16:14.223440079Z",
            "modified_time":  "2026-08-31T16:49:01Z",
            "sha256":  "07cca8298b9df97ebc9a5c6a7d3457aab14d13397a9ad40dabe62ec46a5d35aa",
            "source":  "amazon-inspector",
            "versions":  [
                "88.88.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-019311",
            "import_time":  "2026-08-31T18:22:29.77536951Z",
            "modified_time":  "2026-08-31T18:03:24Z",
            "sha256":  "4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452",
            "source":  "amazon-inspector",
            "versions":  [
                "88.88.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / com.db.autobahn.notification-center-electron

Package

Name
com.db.autobahn.notification-center-electron
View open source insights on deps.dev
Purl
pkg:npm/com.db.autobahn.notification-center-electron

Affected ranges

Affected versions

88.*
88.88.1
88.88.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "c16336aeff434c2a12a373001cef40de06552558af13ffc42fc3d95919445659",
            "tlsh":  "a2f07d38743614733dc59a2c2cc58a0bba619d870b6d34455b87c84837ae3726aba209"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "com.db.autobahn.notification-center-electron-88.88.2.tgz",
            "hashes":  {
                "sha1":  "b84ba1bb07c2dde3a5a13055b0afc96b23ec2e03",
                "sha512_sri":  "sha512-EXvIVSAPub1QUp+04VznGRBpByQi7gHeHkmboSyXTsh14i8Fe9fQvsdFTBP3tXCfr+ylnwIUl0U+khMvE+fMKg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.db.autobahn.notification-center-electron/MAL-2026-15590.json"