MAL-2026-16330

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-materials/MAL-2026-16330.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16330
Published
2026-09-21T03:28:22Z
Modified
2026-09-21T04:00:07Z
Summary
Malicious code in commerce-materials (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d)

commerce-materials@1.0.0 declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020215",
            "import_time": "2026-09-21T03:46:36.619905871Z",
            "modified_time": "2026-09-21T03:28:22Z",
            "sha256": "bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / commerce-materials

Package

Name
commerce-materials
View open source insights on deps.dev
Purl
pkg:npm/commerce-materials

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "ae39c187820502961774874f3376f91f238a1d8027c6a1ca7b1fb9b641f7a683",
            "tlsh": "90d1d6da21ab991115e162d6590e6c036849e0073f0db5e93e2c93a19fc9d3c93b37fb"
        }
    ],
    "package_integrity": [
        {
            "filename": "commerce-materials-1.0.0.tgz",
            "hashes": {
                "sha1": "36539c800ebe930a088c0b4950ab220ebac5115d",
                "sha512_sri": "sha512-zzQZezkIijuf7kA0fHswfi9poV1UNRXMlOe/NAA4SN0IMa2wT1T2MnUq2RM7iMeTt7dUytI5Xfv6mH/Gjkr0yA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-materials/MAL-2026-16330.json"