MAL-2026-17748

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-account-portal-fe/MAL-2026-17748.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17748
Published
2026-10-09T19:10:36Z
Modified
2026-10-13T07:45:14Z
Summary
Malicious code in test-account-portal-fe (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca)

npm package test-account-portal-fe@100.100.101 ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose ("Frontend utilities") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=&u=&p=<npm_package_name>&r=<npm_config_registry>, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.

Source: ossf-package-analysis (5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907)

The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-10-09T19:15:19.362264369Z",
            "modified_time":  "2026-10-09T19:10:36Z",
            "sha256":  "5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907",
            "source":  "ossf-package-analysis",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "id":  "IN-MAL-2026-021423",
            "import_time":  "2026-10-11T14:18:04.381155092Z",
            "modified_time":  "2026-10-11T13:57:11Z",
            "sha256":  "63911c5f393d2276fffe11b7d465b04704722dc852a79fbfbd63b5f8dbd812b8",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.100"
            ]
        },
        {
            "id":  "IN-MAL-2026-021378",
            "import_time":  "2026-10-11T14:18:00.739376595Z",
            "modified_time":  "2026-10-11T13:50:23Z",
            "sha256":  "d9191f0c04c63fc8aa02af2a97681b15cfd241ead915ee30f0b79baa0c4e0200",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.102"
            ]
        },
        {
            "id":  "IN-MAL-2026-021469",
            "import_time":  "2026-10-13T07:32:01.72436852Z",
            "modified_time":  "2026-10-13T07:08:59Z",
            "sha256":  "0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca",
            "source":  "amazon-inspector",
            "versions":  [
                "100.100.101"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / test-account-portal-fe

Package

Name
test-account-portal-fe
View open source insights on deps.dev
Purl
pkg:npm/test-account-portal-fe

Affected ranges

Affected versions

100.*
100.100.100
100.100.101
100.100.102

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "prebuilds/linux-x64/addon.node",
            "sha256":  "d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906",
            "tlsh":  "c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a"
        },
        {
            "path":  "package.json",
            "sha256":  "86fc6110d043ca50d2fee85029e57fb3e90d6d4d34388d0c53e5a621ece55f01",
            "tlsh":  "b2d012140e33963378c04ba55d275a0e65720d6f4004b41c13e3215982dabfb4cbb31e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "test-account-portal-fe-100.100.100.tgz",
            "hashes":  {
                "sha1":  "0841039ad4b8e151fec618983a25fd7758e59af1",
                "sha512_sri":  "sha512-Mml9T4BaC/IR7y0V675pQLyh70mkuEiDSCjeHtDNZmMP/eNTFYzf9AyW+/VUaFwTPhOA+w/d1h4vcjUyQP2ijA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-account-portal-fe/MAL-2026-17748.json"