MAL-2026-15924

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/real-router-telemetry/MAL-2026-15924.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-15924

Published

2026-09-04T06:34:52Z

Modified

2026-09-04T07:00:08.517843404Z

Summary

Malicious code in real-router-telemetry (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450)

Package ships telemetry.js, an obfuscated module (string-array accessor pattern hiding identifiers and the destination) that reads host identity (hostname, username, cwd, platform, arch, memory, cpu info), executes cat /etc/os-release and ps aux, reads .env from the current working directory via fs.readFileSync, and POSTs the collected JSON to https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4, an anonymous request-capture endpoint unrelated to any declared publisher. .env files in a developer's cwd typically contain API keys, tokens, and other credentials that do not belong to this package. package.json declares a postinstall hook (node -e "require('./index.js')"); index.js in this build is a stub (declaring version 1.0.1 while the manifest is 1.0.4) that does not currently require telemetry.js, so the shipped payload is staged but not wired into the install-time entry point in this version. The combination of an obfuscated host-and-secret exfil module targeting an anonymous webhook collector, mismatched version metadata, and an install-time hook aimed at the package's own entry point indicates a malicious package.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T06:53:31.333102704Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-019635",
            "modified_time": "2026-09-04T06:35:01Z",
            "sha256": "339c7fb3c40f724b7ec7c2ac3c67068b03f9d871ec65876913795cff3c2d9537"
        },
        {
            "import_time": "2026-09-04T06:53:31.237576474Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ],
            "id": "IN-MAL-2026-019634",
            "modified_time": "2026-09-04T06:34:52Z",
            "sha256": "78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / real-router-telemetry

Package

Name: real-router-telemetry; View open source insights on deps.dev
Purl: pkg:npm/real-router-telemetry

Affected ranges

Affected versions

1.*

1.0.1

1.0.4

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/real-router-telemetry/MAL-2026-15924.json"

indicators

{
    "evidence_files": [
        {
            "path": "telemetry.js",
            "tlsh": "a24141527ee41e781312a07ed3a33422e393862ab8c16991f09de54c9bcdf05d4e32f4",
            "sha256": "e8f5e8befa52fba91746b3698890453ced8c24d7dcf7accceff2c349e12169fe"
        },
        {
            "path": "package.json",
            "tlsh": "90d0a7700d20963714d407f75db3810756738d7b410cb908179751af80de6b759fe62d",
            "sha256": "462bf33890820506ca6e7ed62fa59bb8cc1c777675fe08c7e01d9258d28d6ceb"
        }
    ],
    "package_integrity": [
        {
            "filename": "real-router-telemetry-1.0.1.tgz",
            "hashes": {
                "sha1": "82ba9311a284ee31f9ac08def9c69438aa16771b",
                "sha512_sri": "sha512-4Hz7cRSSn054Qn15Q+6gpdND3WnqIaieRPP+cALDomozzAY3TA3YhBsDUtGPujdjaAVjH8UREzuUGkIMbJRFww=="
            }
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]