MAL-2026-17182

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-sca-info-banking/MAL-2026-17182.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17182
Published
2026-09-25T08:35:37Z
Modified
2026-09-25T14:30:06Z
Summary
Malicious code in app-sca-info-banking (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b)

package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS (dns.resolve4) and HTTP (http.get) callbacks to unique subdomains under ki6rmdjnq5q8y7v8soxc080fz65ytohd.oastify.com (a Burp Suite Collaborator / OAST host) and writes a marker file under os.tmpdir(). The package's main entry is an empty stub (module.exports = {}); the postinstall payload is the package's only functionality. The DNS/HTTP callbacks to an attacker-controlled OAST domain confirm arbitrary code execution on the installer's host and leak install-event metadata to a third-party endpoint.

Source: ossf-package-analysis (3f5e6f43a1552d09c016e2db6c287a1972a70df70fa7a42d3049840d04580bd4)

The OpenSSF Package Analysis project identified 'app-sca-info-banking' @ 0.0.24 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-09-25T08:46:58.101388316Z",
            "modified_time":  "2026-09-25T08:35:37Z",
            "sha256":  "3f5e6f43a1552d09c016e2db6c287a1972a70df70fa7a42d3049840d04580bd4",
            "source":  "ossf-package-analysis",
            "versions":  [
                "0.0.24"
            ]
        },
        {
            "id":  "IN-MAL-2026-020556",
            "import_time":  "2026-09-25T14:20:34.78312524Z",
            "modified_time":  "2026-09-25T14:10:07Z",
            "sha256":  "9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.24"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / app-sca-info-banking

Package

Name
app-sca-info-banking
View open source insights on deps.dev
Purl
pkg:npm/app-sca-info-banking

Affected ranges

Affected versions

0.*
0.0.24

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "poc.js",
            "sha256":  "c5817444da50bd3e5696204ab5ca04cead18de598638ef2cc220042a5a9ec27a",
            "tlsh":  "f241dfc420f9603426bb088d6dbe18373917db527609b640358c426a8fcabd49e673fc"
        },
        {
            "path":  "package.json",
            "sha256":  "345555687e06b03062050e1f4b471b6e7a8b82596a2fd5bd410c4a721f28315a",
            "tlsh":  "bdd02b2048204d2324c4aa080c675546b1614e2700087c0917e7582c87de13788ff20e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "app-sca-info-banking-0.0.24.tgz",
            "hashes":  {
                "sha1":  "a2e407d5eaa0bde94f7f28659ae052efafa18fb8",
                "sha512_sri":  "sha512-73q7FbCKm8MvCOzGwH6VzcE2x+wmhXUTCvP9st5a8q2OmaqGbiVcuG7bJT98JIDThqVHCfSg4JBibMKj/fBPzw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/app-sca-info-banking/MAL-2026-17182.json"