MAL-2026-16533

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-firestore-synchronize/MAL-2026-16533.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16533
Published
2026-09-22T17:25:36Z
Modified
2026-10-11T17:30:47Z
Summary
Malicious code in exodus-firestore-synchronize (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (210b71fe2403143719408cea9a34626d7788c9aaa87b3f5a1276a92bd5578ce6)

package.json declares a postinstall hook that auto-runs on npm install and executes whoami and hostname, then enumerates process.env for keys matching /TOKEN|SECRET|KEY|AUTH|npm/i and prints the matches to stdout. The package name and description impersonate an internal 'Exodus Wallet SDK' and self-identify as a dependency-confusion demonstrator published to the public registry to intercept installers that misroute an internal package name to this public one. No outbound network sink is present in this version, so the enumerated environment values and host identifiers are written only to the install log rather than transmitted; however, on CI systems those install logs are frequently captured, archived, or exposed, and the enumeration itself targets credential-shaped environment variables.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2026-10730",
            "import_time":  "2026-09-24T09:21:33.65854827Z",
            "modified_time":  "2026-09-22T17:25:36Z",
            "sha256":  "923f195911536ca0b104d559fe5ce4c4a3be249d7a4e2272ae1c1b29cf7d5099",
            "source":  "reversing-labs",
            "versions":  [
                "0.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021456",
            "import_time":  "2026-10-11T17:15:52.231995248Z",
            "modified_time":  "2026-10-11T16:55:28Z",
            "sha256":  "210b71fe2403143719408cea9a34626d7788c9aaa87b3f5a1276a92bd5578ce6",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / exodus-firestore-synchronize

Package

Name
exodus-firestore-synchronize
View open source insights on deps.dev
Purl
pkg:npm/exodus-firestore-synchronize

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "4fdbce83937931356b6722423136268efc04d15aaf9a69dc788c4462eeef0b01",
            "tlsh":  "b5f02b75be447f301c8f16c93c31c11edfca8e0a0400bc7170dbd8854556213487752d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "exodus-firestore-synchronize-0.0.1.tgz",
            "hashes":  {
                "sha1":  "ceaa92dfdb1334b5172cdce41a1952ea0edaf8d3",
                "sha512_sri":  "sha512-TfWHSuS9Hum98fBZuWu5vO9/woJ/fAl8pBJwG9wiqOc0G7qFx1FmBnCM4lqNW3CN9oPEL5uMu658LD2GNoA5Bw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-firestore-synchronize/MAL-2026-16533.json"