MAL-2026-16204

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/alanced-match/MAL-2026-16204.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16204
Published
2026-09-16T06:27:22Z
Modified
2026-09-16T06:45:06Z
Summary
Malicious code in @prime0/alanced-match (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3)

The package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a host fingerprint (hostname, username, platform, arch, cwd, node version, pid, non-internal IP addresses, uptime, package name) to the hardcoded bare-IP endpoint http://69.48.229.140:8080/b. Its main entry index.js opens a require-time HTTP polling channel to the same host, retrieves JSON commands from /c every 30 seconds (with 10-minute re-beacons), executes them via child_process.exec, and posts stdout/stderr back to /r — providing full remote code execution on the installer's machine. A source comment self-identifies the code as a 'Minimal stealth agent' and 'typosquat'.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020072",
            "import_time": "2026-09-16T06:31:14.372842728Z",
            "modified_time": "2026-09-16T06:27:22Z",
            "sha256": "53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @prime0/alanced-match

Package

Name
@prime0/alanced-match
View open source insights on deps.dev
Purl
pkg:npm/%40prime0/alanced-match

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1",
            "tlsh": "ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc"
        },
        {
            "path": "postinstall.js",
            "sha256": "f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c",
            "tlsh": "571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"
        }
    ],
    "package_integrity": [
        {
            "filename": "alanced-match-1.0.0.tgz",
            "hashes": {
                "sha1": "ca2231abea3bb4cad9786e92ccc5a8002df72719",
                "sha512_sri": "sha512-g2qPbOPJmote+Y1VNxEYt28dxGPldP4MczXopsf4P4KnNOfLYHbl371tjPY0dkMnaC0VziO8mHcatiGPLTazgQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/alanced-match/MAL-2026-16204.json"