MAL-2026-16312

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test1df23/MAL-2026-16312.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16312
Published
2026-09-21T03:23:16Z
Modified
2026-09-21T03:30:16Z
Summary
Malicious code in test1df23 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756)

package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, with the package name embedded in the query string (http://128.199.122.145/?test1df23). The beacon fires automatically at install time, leaking the installer's outbound IP and confirming successful execution on the installer's host to the operator of that IP. The package name and near-empty payload are consistent with a dependency-confusion or typosquat probe.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020209",
            "import_time":  "2026-09-21T03:24:21.711502444Z",
            "modified_time":  "2026-09-21T03:23:16Z",
            "sha256":  "67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756",
            "source":  "amazon-inspector",
            "versions":  [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / test1df23

Package

Name
test1df23
View open source insights on deps.dev
Purl
pkg:npm/test1df23

Affected ranges

Affected versions

99.*
99.99.99

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "bbdb734ab5c131ae5843aaa8c10439afcdcde51c8e302613241c6dfde94f527c",
            "tlsh":  "d0c08cc25382f3858bf10882a52a162a230df070b9fd04bae34c23ad489396d11a3ac1"
        },
        {
            "path":  "package.json",
            "sha256":  "8387a0a1e9cb20471006953227d856c284d432dae7ea8963e1b7c66793a6c9b9",
            "tlsh":  "ebe09261cc509a7310f812e5687a1b0bb1626f2b42685c0b34f3b08d66a212644def29"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "test1df23-99.99.99.tgz",
            "hashes":  {
                "sha1":  "048b02f99cf4e79d198d6b4fa23261bf712437d9",
                "sha512_sri":  "sha512-B85Ls4VXh5xhq0za37BZRUB1qJ5KdMfT6fN17d3QopYtuFkHghHItw5rr7tKVdFk3VV2X3UQHfM5rRxt6PdGyg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test1df23/MAL-2026-16312.json"