MAL-2026-16205

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/inimatch/MAL-2026-16205.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16205
Published
2026-09-16T06:27:42Z
Modified
2026-09-16T06:45:06Z
Summary
Malicious code in @prime0/inimatch (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d094698410f0146ad3f51ff8860d657ca28b5f55b77ef9593b637b956996180f)

@prime0/inimatch is a typosquat of minimatch that behaves as a stealth remote-access agent. postinstall.js runs on npm install and POSTs a host fingerprint (hostname, username, platform/arch, cwd, node version, pid, non-internal IPs, uptime, package name) to http://69.48.229.140:8080/b. index.js, on require(), beacons the same fingerprint to /b and then every 30 seconds polls http://69.48.229.140:8080/c?id=... for a JSON command, passes the returned command string to child_process.exec, and POSTs stdout/stderr back to /r, giving the operator of that host arbitrary shell execution on the installer's machine. A source comment self-identifies the package as a stealth-agent typosquat, while package.json advertises only a 'small utility'.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020074",
            "import_time":  "2026-09-16T06:31:14.550585151Z",
            "modified_time":  "2026-09-16T06:27:42Z",
            "sha256":  "d094698410f0146ad3f51ff8860d657ca28b5f55b77ef9593b637b956996180f",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @prime0/inimatch

Package

Name
@prime0/inimatch
View open source insights on deps.dev
Purl
pkg:npm/%40prime0/inimatch

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1",
            "tlsh":  "ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc"
        },
        {
            "path":  "postinstall.js",
            "sha256":  "f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c",
            "tlsh":  "571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "inimatch-1.0.0.tgz",
            "hashes":  {
                "sha1":  "59a8e88dfe0733f425312f47d8ee3add38aaae87",
                "sha512_sri":  "sha512-3NBiobww3R3uflrXIFMFGOOxHDOQCKBJMSjqIltr5tS/PajOuzHNZ1QDzpdzMRITBaA0OCkF8A0MaohVgtDTVg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/inimatch/MAL-2026-16205.json"