MAL-2026-17437

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bluewin/utils/MAL-2026-17437.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17437
Published
2026-10-01T02:40:08Z
Modified
2026-10-04T23:45:17Z
Summary
Malicious code in @bluewin/utils (npm)
Details

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs node postinstall.js on npm install, which sends an HTTPS request to https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils, a Burp Collaborator endpoint, disclosing the installing host's IP address and that it installed the package. It collects no further data, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account securityresearch1 published it on 2026-10-01.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e11917724d1e65e5bb29f8e93e5ebafc9be1bac419a014f35ddd460bcae26265)

@bluewin/utils@1.0.0 ships a postinstall lifecycle script that performs an HTTPS GET to a hardcoded Burp Collaborator subdomain at https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils on every install. The request path embeds the package coordinate, and the outbound DNS resolution and HTTP hit confirm code execution on the installer's machine and disclose the installer's resolver/egress IP to the operator of the oastify.com subdomain. The @bluewin scope and utility name are consistent with a dependency-confusion probe targeting an internal package namespace: any build system that resolves @bluewin/utils from the public npm registry instead of a private registry will fetch and run this beacon at install time. Although the behavior is a reconnaissance beacon rather than a full payload, it establishes attacker-side confirmation of exploitability and leaks environment metadata without consent.

Database specific 
{
    "iocs":  {
        "domains":  [
            "5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "628e04ce4e3165269e4505b10af93a2df7f689fad6bcbf49409d7be7e18bf300"
                },
                "note":  "postinstall script: node postinstall.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "68324659e177d6de76125da39ab3ca96e27a9d3890692a12a652c18471163770"
                },
                "note":  "Executed by the postinstall script of @bluewin/utils@1.0.0.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020944",
            "import_time":  "2026-10-04T23:40:44.602134313Z",
            "modified_time":  "2026-10-04T23:23:53Z",
            "sha256":  "e11917724d1e65e5bb29f8e93e5ebafc9be1bac419a014f35ddd460bcae26265",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bluewin/utils

Package

Name
@bluewin/utils
View open source insights on deps.dev
Purl
pkg:npm/%40bluewin/utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "postinstall.js",
            "sha256":  "68324659e177d6de76125da39ab3ca96e27a9d3890692a12a652c18471163770",
            "tlsh":  "a2c022f513d057340d2061c09208ec0ee2c7e06432ccdec1490901736ac1bba89a32c1"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "utils-1.0.0.tgz",
            "hashes":  {
                "sha1":  "47a5ed82fb921060b2b91a8b155e4f24ab4b3810",
                "sha512_sri":  "sha512-byy6riUGUFddt6p7AuUJtcC0tnFKsuTsy+2PMdAQ2+nU5gm3P9S4VH35UKB+mTUQ1hyxwfMJRa7KQpJLBjBrRA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bluewin/utils/MAL-2026-17437.json"