MAL-2026-16326

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/byted-commerce-materials/MAL-2026-16326.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16326
Published
2026-09-21T03:29:19Z
Modified
2026-09-21T04:00:07Z
Summary
Malicious code in byted-commerce-materials (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da)

package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collects hostname, username, platform, cwd, home directory, network interfaces, uid/gid, CI/cloud provider fingerprints, and probes the working directory for credential files (.env,.npmrc,.yarnrc,.git/config,.docker/config.json, credentials, secrets.json). It also enumerates process.env keys and filters them against a broad credential-name regex set (token, secret, key, password, aws, azure, gcp, npm, ssh, private, credential, jwt, bearer, stripe, db, mysql, postgres, mongo, redis). The collected payload is POSTed to api.telegram.org via a hardcoded Telegram Bot API token and chat_id (1064260758). A secondary DNS-based side channel base64-encodes host/user/CI fields and issues a dns.resolve against a <encoded>.dc-callback.example.com subdomain as a fallback for environments that block HTTPS to Telegram. The package presents itself as a byted/commerce materials module and a security research / dependency confusion PoC; the self-label does not change that the traced behavior harvests installer host and credential reconnaissance and ships it off-host to attacker-controlled channels without consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020221",
            "import_time": "2026-09-21T03:46:37.176180126Z",
            "modified_time": "2026-09-21T03:29:19Z",
            "sha256": "f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / byted-commerce-materials

Package

Name
byted-commerce-materials
View open source insights on deps.dev
Purl
pkg:npm/byted-commerce-materials

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "ae39c187820502961774874f3376f91f238a1d8027c6a1ca7b1fb9b641f7a683",
            "tlsh": "90d1d6da21ab991115e162d6590e6c036849e0073f0db5e93e2c93a19fc9d3c93b37fb"
        }
    ],
    "package_integrity": [
        {
            "filename": "byted-commerce-materials-1.0.0.tgz",
            "hashes": {
                "sha1": "ef5890b740998fac00ef748880d8df2d732392ad",
                "sha512_sri": "sha512-sB7tObISPcCc85cqkE9ACZjGSauPwTUqwEtemyhE+C4WIySciCXodrSkCm7yzM1vzlg1Fzs0AVC8hEdtb9NQBw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/byted-commerce-materials/MAL-2026-16326.json"