MAL-2026-17420

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/online-header/MAL-2026-17420.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17420
Published
2026-10-01T14:55:35Z
Modified
2026-10-04T23:45:17Z
Summary
Malicious code in online-header (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761)

online-header@99.0.0 is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose preinstall lifecycle script runs node callback.js. callback.js collects host identifiers — os.hostname(), os.userInfo().username, __dirname install path, Node version, os.platform() and os.arch() — and POSTs them via https.request to the hardcoded Burp Collaborator OAST endpoint https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com, with a DNS-based backup channel to the same subdomain. On any build system that resolves online-header from the public registry (for example, an internal package of the same name shadowed by this public release), npm install automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control.

Source: ossf-package-analysis (161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc)

The OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-10-01T15:19:28.067690628Z",
            "modified_time":  "2026-10-01T14:55:35Z",
            "sha256":  "161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc",
            "source":  "ossf-package-analysis",
            "versions":  [
                "99.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020938",
            "import_time":  "2026-10-04T23:40:43.951007383Z",
            "modified_time":  "2026-10-04T23:22:54Z",
            "sha256":  "4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / online-header

Package

Name
online-header
View open source insights on deps.dev
Purl
pkg:npm/online-header

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "callback.js",
            "sha256":  "648abc9be856dafce010b53ab6273ed0713cc61e889b999e59c0d80b8e37e299",
            "tlsh":  "472153e522f4b2752be1efd086632b565652c066350beae0f88d03189bcb62d82335d7"
        },
        {
            "path":  "package.json",
            "sha256":  "508eaee88cd8f11d305febf68b30fa20172dffa860e4bf1d1ea982186bca6e5f",
            "tlsh":  "7dd0a764ac11b83328f996f2493651191174dd1f99481d6da5c6410c81996e68677189"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "online-header-99.0.0.tgz",
            "hashes":  {
                "sha1":  "986226971f9c0a419b76188585a63924ed286951",
                "sha512_sri":  "sha512-bIKIroRqeiZdeUa06MY1Rvmwh3bTI2JLLRfMKCiH3XsMUqFQe/YSPl5C7uUKFbqVf79W8lXLdp0D5AcL0AlkpQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/online-header/MAL-2026-17420.json"