MAL-2026-16311

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test12vv36/MAL-2026-16311.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16311
Published
2026-09-21T03:23:35Z
Modified
2026-09-21T03:30:17Z
Summary
Malicious code in test12vv36 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be)

test12vv36@99.99.99 declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020211",
            "import_time": "2026-09-21T03:24:21.934740204Z",
            "modified_time": "2026-09-21T03:23:35Z",
            "sha256": "9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / test12vv36

Package

Name
test12vv36
View open source insights on deps.dev
Purl
pkg:npm/test12vv36

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "bc8d807a41cca39765c8272af40c02735cfd226420e8c8ab16da5227d41fbcf9",
            "tlsh": "57c08cc25382f3848bf1088269292616230df170b9fc04b6e34c23ad488397d25a3ac1"
        },
        {
            "path": "package.json",
            "sha256": "052723013adc7fb5de8366d0af1c6b432299b1d63896675a6112f8e06aaf9aaf",
            "tlsh": "fbe09261cc609a7314fc12e568791b07b1625f2b42685c0b34f3b48d66a2126449ef29"
        }
    ],
    "package_integrity": [
        {
            "filename": "test12vv36-99.99.99.tgz",
            "hashes": {
                "sha1": "89863594917a314d392f5458c2423134d0638349",
                "sha512_sri": "sha512-ttBwu8SPnBNfLLTH96s2SL14wm1Sn4j2IYRzUr6gtpydWnxag5Ymwp6x3l5Lix/g93hmQao6CAyszfPla2aijA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test12vv36/MAL-2026-16311.json"