MAL-2026-17762

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@coopeuch/config/MAL-2026-17762.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17762
Published
2026-10-11T13:51:00Z
Modified
2026-10-11T14:30:08Z
Summary
Malicious code in @coopeuch/config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d)

The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope registry when an organization's scope-to-registry mapping is missing. On npm install, scripts.postinstall executes postinstall.js, which collects host identity (hostname, username, uid/gid, homedir, non-internal network interface addresses and MAC addresses, DNS servers, reverse-DNS internal FQDN), CI/orchestration markers, npm context, container detection via /proc/1/cgroup, and the consuming parent package's name, version, and declared version range, then POSTs the aggregated JSON over HTTPS to the hardcoded author endpoint collector.oob.s4yhii.com/_npm-poc/beacon alongside a DNS beacon under *.oob.s4yhii.com. The behavior fires automatically at install time without consent and reveals internal infrastructure details and private project identifiers of any organization whose build resolves this package from the public registry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021382",
            "import_time": "2026-10-11T14:18:01.035704786Z",
            "modified_time": "2026-10-11T13:51:00Z",
            "sha256": "0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d",
            "source": "amazon-inspector",
            "versions": [
                "1.999.999"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @coopeuch/config

Package

Name
@coopeuch/config
View open source insights on deps.dev
Purl
pkg:npm/%40coopeuch/config

Affected ranges

Affected versions

1.*
1.999.999

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "c859191e9d7e04d59b5d2f566799feb31594a68573350bd17661be469e8663ef",
            "tlsh": "0ae1fa6a05fe1132226235f4694b50156776d1633504fbf4b9dd8280afcf0ba42bb7ed"
        },
        {
            "path": "package.json",
            "sha256": "4ca94fd65701e7bf32fc00c7c1fdd1336b139f8c2dc66d249be83cf3877df659",
            "tlsh": "6be0e53085214f33a4d419a90d372545509a295347083c1463e7426c4b9c77a88ff32d"
        }
    ],
    "package_integrity": [
        {
            "filename": "config-1.999.999.tgz",
            "hashes": {
                "sha1": "79c25e547363f0f616d9a572cc246b0df84be318",
                "sha512_sri": "sha512-LjhqpLTjaqIy40i0+L42YJ4LrS7TmGITT0w7PTj0eN3f1pGv00MhnEZ0dMzmAjoMTzOhaizWzCsKy3JoXFPPvw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@coopeuch/config/MAL-2026-17762.json"