MAL-2026-17746

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kmf-bootstrap/MAL-2026-17746.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17746
Published
2026-10-09T19:10:34Z
Modified
2026-10-11T14:30:09Z
Summary
Malicious code in kmf-bootstrap (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74)

On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npm_package_name and issues DNS resolutions for a label of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me, leaking those identifiers to an Interactsh (oast.me) collaborator over DNS. Second, postinstall.js require()s a shipped Linux x64 native addon at prebuilds/linux-x64/addon.node that calls gethostname() and getpwuid()->pw_name and reads the npm_package_name and npm_config_registry environment variables, then opens a raw socket and sends an HTTP POST with body h=&u=&p=&r= to the bare IP 64.181.165.115 (Host header 64.181.165.115, path /dc, HTTP/1.0, no TLS). The destination is a bare IP with no relation to the package publisher and the npm_config_registry value can disclose a private/internal registry URL from the installer's.npmrc. The native component is opaque code auto-executed during install with host-level network egress. The package name resembles the common 'bootstrap' naming convention, consistent with a dependency-confusion / typosquat lure whose purpose is to beacon successful installs and private registry metadata.

Source: ossf-package-analysis (4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b)

The OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-10-09T19:15:19.265428863Z",
            "modified_time":  "2026-10-09T19:10:34Z",
            "sha256":  "4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b",
            "source":  "ossf-package-analysis",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "import_time":  "2026-10-09T19:41:44.128123577Z",
            "modified_time":  "2026-10-09T19:25:54Z",
            "sha256":  "cc9f15e56fb0bf13a7c0bb8ebfa0eeeaa376629272d6fed9073b9c338e1c6862",
            "source":  "ossf-package-analysis",
            "versions":  [
                "100.100.103"
            ]
        },
        {
            "id":  "IN-MAL-2026-021398",
            "import_time":  "2026-10-11T14:18:02.341341906Z",
            "modified_time":  "2026-10-11T13:53:23Z",
            "sha256":  "2405275a8f22c4e8d737c5bb93149a073ddecb6a6daf67715cb4bc2218f76161",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.106"
            ]
        },
        {
            "id":  "IN-MAL-2026-021385",
            "import_time":  "2026-10-11T14:18:01.319831262Z",
            "modified_time":  "2026-10-11T13:51:32Z",
            "sha256":  "746ee8923cc246b2816dd79a756552ce7975ae9305f195b502f9225a348e00ec",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.101"
            ]
        },
        {
            "id":  "IN-MAL-2026-021388",
            "import_time":  "2026-10-11T14:18:01.54674888Z",
            "modified_time":  "2026-10-11T13:51:57Z",
            "sha256":  "956976b01563579f32919e883c10229d2cf459fa2253ca34bd164fe83016a567",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.103"
            ]
        },
        {
            "id":  "IN-MAL-2026-021413",
            "import_time":  "2026-10-11T14:18:03.53680973Z",
            "modified_time":  "2026-10-11T13:55:39Z",
            "sha256":  "b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "id":  "IN-MAL-2026-021426",
            "import_time":  "2026-10-11T14:18:04.609307912Z",
            "modified_time":  "2026-10-11T13:57:41Z",
            "sha256":  "dbbe7e819b6a360576d8c7ea55ef5da42e2bbb24596548235569fa9f8df6d646",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.100"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / kmf-bootstrap

Package

Name
kmf-bootstrap
View open source insights on deps.dev
Purl
pkg:npm/kmf-bootstrap

Affected ranges

Affected versions

100.*
100.100.100
100.100.101
100.100.102
100.100.103
100.100.106

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "ad83f21106b39d76f42ab4914cf4f2c718774afbc56db120903cfc774cba9c43",
            "tlsh":  "97f0e5aa4a7055a01a97120dd33f680aa8e7f1276c8a95407e9d66910f7061222511f8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "kmf-bootstrap-100.100.106.tgz",
            "hashes":  {
                "sha1":  "c33c469662a02914b6e599eff5771311d5aafbd3",
                "sha512_sri":  "sha512-2rRl/0EjP1UAqNE8YO1cyEogeuJibH1LNXtNdZzXy/8yp2KSVbrABL2soJgWoM6mSp6t6QKpI2/Ew/dcJLTHjg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kmf-bootstrap/MAL-2026-17746.json"