MAL-2026-16218

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tol8t/MAL-2026-16218.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16218
Published
2026-09-15T20:05:48Z
Modified
2026-09-16T10:30:09Z
Summary
Malicious code in tol8t (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27)

package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/. The preinstall hook sends the installer's current working directory ($(pwd)) and the postinstall hook sends the machine hostname ($(hostname)). Both fire automatically during npm install with no user interaction. The package ships no other functionality; its sole behavior is host reconnaissance beaconing to an attacker-controlled Discord webhook.

Source: ossf-package-analysis (2f9850f64422a733207e07792098b0e3c72d43311f73a44bd07ae0c2dd4429eb)

The OpenSSF Package Analysis project identified 'tol8t' @ 14.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020084",
            "import_time": "2026-09-16T06:56:08.696676448Z",
            "modified_time": "2026-09-16T06:35:20Z",
            "sha256": "c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27",
            "source": "amazon-inspector",
            "versions": [
                "14.0.0"
            ]
        },
        {
            "import_time": "2026-09-16T10:19:31.278636485Z",
            "modified_time": "2026-09-15T20:05:48Z",
            "sha256": "2f9850f64422a733207e07792098b0e3c72d43311f73a44bd07ae0c2dd4429eb",
            "source": "ossf-package-analysis",
            "versions": [
                "14.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tol8t

Package

Name
tol8t
View open source insights on deps.dev
Purl
pkg:npm/tol8t

Affected ranges

Affected versions

14.*
14.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "69c60f355331f8f0f6364e12af72204e6453d8874ef236065d33e09aec4fac55",
            "tlsh": "4e01d0f19e217632bbd795f71a2756586fe3685f1804582ca19346ac21cc367203668b"
        }
    ],
    "package_integrity": [
        {
            "filename": "tol8t-14.0.0.tgz",
            "hashes": {
                "sha1": "f24080f43309bd1b57d293a65584801b46453f8f",
                "sha512_sri": "sha512-LzdFYiStEIDAcA0FUj3kDnsrQ52qaKh79OY+R83GoG7GA+5tvmVFKgIk4w5AhlZuZ4O0CqJhCkqX05Hwu+zZsQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tol8t/MAL-2026-16218.json"