MAL-2026-17771

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ksp-client-registry/MAL-2026-17771.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17771
Published
2026-10-11T13:56:54Z
Modified
2026-10-11T14:30:09Z
Summary
Malicious code in ksp-client-registry (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018)

The npm package ksp-client-registry@100.100.100 ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main (index.js require of./prebuilds/linux-x64/addon). On load the addon reads the HOSTNAME, npm_package_name, and npm_config_registry environment variables and opens a raw TCP socket to the hardcoded IP 64.181.165.115, sending them in an HTTP request of the form 'POST /dc HTTP/1.0' with a body shaped as 'h=&p=&u=&r='. ELF strings corroborate the behavior: '64.181.165.115', 'POST /dc HTTP/1.0', 'Host: 64.181.165.115', 'HOSTNAME', 'npm_package_name', 'npm_config_registry', and imports of socket/connect/send/fork/getenv/inet_pton. package.json declares a postinstall ('node postinstall.js') providing an install-time footprint, and any require() of the package triggers the beacon regardless. The addon exposes no legitimate N-API functionality beyond module registration. The implausibly high version (100.100.100) and generic registry-style name are consistent with a dependency-confusion probe designed to be resolved in place of an internal package and to report back the victim host, internal package name, and configured registry URL to the operator.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021422",
            "import_time": "2026-10-11T14:18:04.311865673Z",
            "modified_time": "2026-10-11T13:57:03Z",
            "sha256": "3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018",
            "source": "amazon-inspector",
            "versions": [
                "100.100.100"
            ]
        },
        {
            "id": "IN-MAL-2026-021421",
            "import_time": "2026-10-11T14:18:04.233387431Z",
            "modified_time": "2026-10-11T13:56:54Z",
            "sha256": "44dd37ed96611f26302ed323de01f14fba9077aa6798410193047ab11d7ffc81",
            "source": "amazon-inspector",
            "versions": [
                "100.100.101"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ksp-client-registry

Package

Name
ksp-client-registry
View open source insights on deps.dev
Purl
pkg:npm/ksp-client-registry

Affected ranges

Affected versions

100.*
100.100.100
100.100.101

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "prebuilds/linux-x64/addon.node",
            "sha256": "d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906",
            "tlsh": "c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a"
        },
        {
            "path": "package.json",
            "sha256": "e1a888bd3962ef93dd6daed6e141905ef006bd17be71d537875ffb26a2c9c971",
            "tlsh": "28d012144e229a3339c547a99d27950a59720e5f5144b81813a325ad42d9bbb4cbf31e"
        }
    ],
    "package_integrity": [
        {
            "filename": "ksp-client-registry-100.100.100.tgz",
            "hashes": {
                "sha1": "5aca2fa379d08067aa6aa3f1c79bf09302e2c3c1",
                "sha512_sri": "sha512-t9/b9p6Xq6rhb3TqM30Kr+Ue06kAx1As9cXBCaX4aWl7LUsEA+m9m4IBrTxX2pwB86JmIOIeweOirmVWkPqcOQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ksp-client-registry/MAL-2026-17771.json"