MAL-2026-16330

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-materials/MAL-2026-16330.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16330
Published
2026-09-21T03:28:22Z
Modified
2026-09-21T04:00:07Z
Summary
Malicious code in commerce-materials (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d)

commerce-materials@1.0.0 declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020215",
            "import_time":  "2026-09-21T03:46:36.619905871Z",
            "modified_time":  "2026-09-21T03:28:22Z",
            "sha256":  "bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / commerce-materials

Package

Name
commerce-materials
View open source insights on deps.dev
Purl
pkg:npm/commerce-materials

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "callback.js",
            "sha256":  "ae39c187820502961774874f3376f91f238a1d8027c6a1ca7b1fb9b641f7a683",
            "tlsh":  "90d1d6da21ab991115e162d6590e6c036849e0073f0db5e93e2c93a19fc9d3c93b37fb"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "commerce-materials-1.0.0.tgz",
            "hashes":  {
                "sha1":  "36539c800ebe930a088c0b4950ab220ebac5115d",
                "sha512_sri":  "sha512-zzQZezkIijuf7kA0fHswfi9poV1UNRXMlOe/NAA4SN0IMa2wT1T2MnUq2RM7iMeTt7dUytI5Xfv6mH/Gjkr0yA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-materials/MAL-2026-16330.json"