MAL-2026-16206

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/pcomatch/MAL-2026-16206.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16206
Published
2026-09-16T06:27:31Z
Modified
2026-09-16T06:45:06Z
Summary
Malicious code in @prime0/pcomatch (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816)

index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On npm install, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On require() of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the c field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020073",
            "import_time": "2026-09-16T06:31:14.494431104Z",
            "modified_time": "2026-09-16T06:27:31Z",
            "sha256": "08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @prime0/pcomatch

Package

Name
@prime0/pcomatch
View open source insights on deps.dev
Purl
pkg:npm/%40prime0/pcomatch

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c",
            "tlsh": "571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"
        },
        {
            "path": "index.js",
            "sha256": "a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1",
            "tlsh": "ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc"
        }
    ],
    "package_integrity": [
        {
            "filename": "pcomatch-1.0.0.tgz",
            "hashes": {
                "sha1": "1169c8d460a4cd79a384a0fdfe155ef5fc2f346e",
                "sha512_sri": "sha512-p7NofNwT8UfpWnHQCH3C2appuPLy2YUEjcIy3Z4tNEJFXW438C+Gcf6h6Oigi7nfqm00a2Hv0Db55NNMkxaJGA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/pcomatch/MAL-2026-16206.json"