MAL-2026-15590

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.db.autobahn.notification-center-electron/MAL-2026-15590.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15590
Published
2026-08-30T02:04:57Z
Modified
2026-08-31T18:31:22.153973113Z
Summary
Malicious code in com.db.autobahn.notification-center-electron (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452)

package.json declares preinstall and postinstall lifecycle scripts that automatically run curl on npm install to send installer identity (whoami, hostname, $PWD, timestamp) as query-string parameters to a long-random-label third-party host (da9nfhavbsgte1dqq8fgrbb7fyfekc37i.cyowl.com) over plain HTTP. The package name (com.db.autobahn.notification-center-electron) and implausibly high version (88.88.1) are consistent with a dependency-confusion lure targeting an internal scope; installing this package leaks host reconnaissance data to an external endpoint.

Source: ossf-package-analysis (fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807)

The OpenSSF Package Analysis project identified 'com.db.autobahn.notification-center-electron' @ 88.88.2 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-30T23:14:56.250461164Z",
            "source": "ossf-package-analysis",
            "versions": [
                "88.88.2"
            ],
            "modified_time": "2026-08-30T02:04:57Z",
            "sha256": "fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807"
        },
        {
            "import_time": "2026-08-31T17:16:14.223440079Z",
            "source": "amazon-inspector",
            "versions": [
                "88.88.2"
            ],
            "id": "IN-MAL-2026-019173",
            "modified_time": "2026-08-31T16:49:01Z",
            "sha256": "07cca8298b9df97ebc9a5c6a7d3457aab14d13397a9ad40dabe62ec46a5d35aa"
        },
        {
            "import_time": "2026-08-31T18:22:29.77536951Z",
            "id": "IN-MAL-2026-019311",
            "versions": [
                "88.88.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-31T18:03:24Z",
            "sha256": "4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452"
        }
    ]
}
References
Credits

Affected packages

npm / com.db.autobahn.notification-center-electron

Package

Name
com.db.autobahn.notification-center-electron
View open source insights on deps.dev
Purl
pkg:npm/com.db.autobahn.notification-center-electron

Affected ranges

Affected versions

88.*
88.88.1
88.88.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/com.db.autobahn.notification-center-electron/MAL-2026-15590.json"
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "a2f07d38743614733dc59a2c2cc58a0bba619d870b6d34455b87c84837ae3726aba209",
            "sha256": "c16336aeff434c2a12a373001cef40de06552558af13ffc42fc3d95919445659"
        }
    ],
    "package_integrity": [
        {
            "filename": "com.db.autobahn.notification-center-electron-88.88.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-EXvIVSAPub1QUp+04VznGRBpByQi7gHeHkmboSyXTsh14i8Fe9fQvsdFTBP3tXCfr+ylnwIUl0U+khMvE+fMKg==",
                "sha1": "b84ba1bb07c2dde3a5a13055b0afc96b23ec2e03"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]