MAL-2026-17747

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kmf-i18n/MAL-2026-17747.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17747
Published
2026-10-09T19:10:42Z
Modified
2026-10-11T14:30:09Z
Summary
Malicious code in kmf-i18n (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c)

kmf-i18n@100.100.100 is published with the version-number and behavior shape of a dependency-confusion reconnaissance beacon rather than an i18n library. The tarball ships a Linux x64 N-API binary at prebuilds/linux-x64/addon.node with no corresponding source, no binding.gyp, and no build step. package.json declares scripts.postinstall = "node postinstall.js", and postinstall.js require()s that prebuilt.node binary, so the native code is loaded automatically on npm install. The addon opens a raw TCP socket to the hardcoded bare IP 64.181.165.115 on port 80 and sends an HTTP/1.0 POST to /dc with body h=&p=<npm_package_name>&u=&r=<npm_config_registry>, reading those values from the installer's environment. The exfiltrated npm_config_registry value discloses internal/private npm registry URLs, which is the characteristic signal of dependency-confusion target reconnaissance. The addon exposes no i18n functionality consistent with the package's declared purpose; its only observable behavior is the install-time beacon. The main entry also require()s the same binary, so merely importing the package re-triggers the native load path.

Source: ossf-package-analysis (c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1)

The OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-10-09T19:15:19.485365629Z",
            "modified_time":  "2026-10-09T19:10:42Z",
            "sha256":  "c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1",
            "source":  "ossf-package-analysis",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "id":  "IN-MAL-2026-021418",
            "import_time":  "2026-10-11T14:18:04.003362059Z",
            "modified_time":  "2026-10-11T13:56:29Z",
            "sha256":  "6ea0a9b64d2c7100bfc55c2849fc7b51fe7c967850bfc5a17a0295a4bbfa85c7",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.101"
            ]
        },
        {
            "id":  "IN-MAL-2026-021416",
            "import_time":  "2026-10-11T14:18:03.756742815Z",
            "modified_time":  "2026-10-11T13:56:09Z",
            "sha256":  "b0331a73dd7ea6088c8c63d37751490d0834a305d6a7ddb6cd55de2e0741ff3e",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "id":  "IN-MAL-2026-021425",
            "import_time":  "2026-10-11T14:18:04.542531921Z",
            "modified_time":  "2026-10-11T13:57:29Z",
            "sha256":  "ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.100"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / kmf-i18n

Package

Name
kmf-i18n
View open source insights on deps.dev
Purl
pkg:npm/kmf-i18n

Affected ranges

Affected versions

100.*
100.100.100
100.100.101
100.100.102

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "prebuilds/linux-x64/addon.node",
            "sha256":  "1798796310908fa36529d480c1c8eb644195a9539cb574531b3eb3278458f1d5",
            "tlsh":  "2972251bb361c93fc4e84334054b5a6572b6a4746b7313231f04a67e3ce27985e7aa8f"
        },
        {
            "path":  "index.js",
            "sha256":  "8222b8169ee86f25cdccd84d340340060ae3f0cff55e2ea9d344d7c332733b71"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "kmf-i18n-100.100.101.tgz",
            "hashes":  {
                "sha1":  "e158594cf93f61363356c55576974627c259443d",
                "sha512_sri":  "sha512-14j1jdjA2we2UA6m7JlQSCwoGr062MaCIpGHT5FVuuOhQZPl86YrKYzxG8cf7ADS+6a40PPwlZZbDLXNRacUew=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kmf-i18n/MAL-2026-17747.json"