MAL-2026-16315

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test1ro/MAL-2026-16315.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16315
Published
2026-09-21T03:23:24Z
Modified
2026-09-21T03:30:17Z
Summary
Malicious code in test1ro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e)

package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname() and issues an HTTP GET to the hardcoded third-party collector http://eo8f3m3ho26a0nm.m.pipedream.net/<package>?h=<hostname>. The behavior fires automatically during npm install without any user action, transmitting the installer's host identifier and the resolved package name to an external Pipedream request-bin. The manifest also declares test1ro: ^999.99.99 as its own dependency at an implausibly high version, characteristic of a dependency-confusion artifact designed to be resolved from public npm ahead of an internal package of the same name. The generic name, self-referential high-version pin, and install-time beacon to an attacker-controlled collector match the standard dependency-confusion probe shape.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020212",
            "import_time": "2026-09-21T03:24:22.034134991Z",
            "modified_time": "2026-09-21T03:23:46Z",
            "sha256": "8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e",
            "source": "amazon-inspector",
            "versions": [
                "999.99.99"
            ]
        },
        {
            "id": "IN-MAL-2026-020210",
            "import_time": "2026-09-21T03:24:21.78694115Z",
            "modified_time": "2026-09-21T03:23:24Z",
            "sha256": "9b4c1e61651ca7fc4d5b2dc93bc240ffd6339dfe0fde02e66740517cc9c957bf",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / test1ro

Package

Name
test1ro
View open source insights on deps.dev
Purl
pkg:npm/test1ro

Affected ranges

Affected versions

99.*
99.99.99
999.*
999.99.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "85d31266e09f74f188b3569976632d1aef8cab83e7d328572d413c057661d89f",
            "tlsh": "80e02bc707d9b37079e18ec0e03709077386e13635b8c2b4a14d87e95dd2ca509b36e0"
        },
        {
            "path": "package.json",
            "sha256": "945bd51f89f48bbff4c92d6c82d5a743b0eaf25ff99033f4a461abd2a1217d4b",
            "tlsh": "52e06551dc509b7314f816d868792b07b1515f2f97685c4b34f3b08da6a222740deb29"
        }
    ],
    "package_integrity": [
        {
            "filename": "test1ro-999.99.99.tgz",
            "hashes": {
                "sha1": "3c02cbcbf4cdbf6a8becead818c0528b21371f83",
                "sha512_sri": "sha512-+n1Hh+06rQpOkt7eeiIzgBlnZ589WQcvugB2ucJFlzcKKNfbOQEEEP7IB/5+xAcUKiZ0zQ785dx0ObdrUqCb3g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test1ro/MAL-2026-16315.json"