MAL-2026-16351

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16351
Published
2026-09-21T17:15:31Z
Modified
2026-09-21T17:45:06Z
Summary
Malicious code in @baanx/abis (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b)

Package declares scripts.install: node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (os.userInfo().username), hostname (os.hostname()), and current working directory basename (process.cwd()), joins them with a timestamp and the prefix bxabis under the suffix oob.algamil7x.xyz, and issues a dns.resolve4 lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on npm install and again on require. The module names, method references (_load('os'), _load('dns'), userInfo, hostname, cwd, resolve4), the prefix bxabis, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry telemetry/connectivity probe cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020263",
            "import_time":  "2026-09-21T17:38:31.674056583Z",
            "modified_time":  "2026-09-21T17:15:31Z",
            "sha256":  "647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b",
            "source":  "amazon-inspector",
            "versions":  [
                "9.9.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @baanx/abis

Package

Name
@baanx/abis
View open source insights on deps.dev
Purl
pkg:npm/%40baanx/abis

Affected ranges

Affected versions

9.*
9.9.11

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "runtime/support/telemetry/probe/impl.js",
            "sha256":  "ae4b73688385daef20c226d80792a6c877557cdfce7a925c14da94b27454621c",
            "tlsh":  "a4119c5ab253d0cf23d04699391c53e1482d82d097dd11d2bbbc169ba28d7914ad3a66"
        },
        {
            "path":  "runtime/support/telemetry/probe/c7a1f4.js",
            "sha256":  "f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1",
            "tlsh":  "73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "abis-9.9.11.tgz",
            "hashes":  {
                "sha1":  "9467fff23faf27f4a13db5422a7b3ed51e996b6d",
                "sha512_sri":  "sha512-L5KzeFHJlL12gkUX6WvUtXrbEEqopKRW4A6K4qWK0nXZwURwfbi+5W6mf9FnZY4sTuT2jbnEWh77OuSkOc/QgQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json"