MAL-2026-18439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@an1mshnpmb9c84920/pipeprobe-obf-m19n5/MAL-2026-18439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18439
Published
2026-11-02T01:50:19Z
Modified
2026-11-02T02:30:04Z
Summary
Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2)

The package's prepare lifecycle script executes node index.js, which reconstructs the hostname npmp19n5--768.oob.awss.dev by joining a string array and issues a DNS lookup via require('dns').lookup(...). The destination is an out-of-band application-security-testing callback host carrying a unique per-package label, so installing the package confirms code execution on the installer's machine to the operator of that domain. The hostname is assembled from an array of fragments at runtime rather than appearing as a plain literal, concealing the destination from static scanners. The package provides no legitimate functionality consistent with a lifecycle-time DNS callback to an external token-bearing host.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022479",
            "import_time":  "2026-11-02T02:17:04.542985446Z",
            "modified_time":  "2026-11-02T01:50:19Z",
            "sha256":  "66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @an1mshnpmb9c84920/pipeprobe-obf-m19n5

Package

Name
@an1mshnpmb9c84920/pipeprobe-obf-m19n5
View open source insights on deps.dev
Purl
pkg:npm/%40an1mshnpmb9c84920/pipeprobe-obf-m19n5

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "e0bb38786bbe3e826ddd73fe8c59441594f381187ef64e281a33c594da3ae502",
            "tlsh":  "35b09b4d4410925513268067d374475a98f7fbc155448055f534cc99125547596d5494"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "pipeprobe-obf-m19n5-1.0.0.tgz",
            "hashes":  {
                "sha1":  "8df2c8b6764af33bc2167ff40363f4eeedf1ba3f",
                "sha512_sri":  "sha512-RFCuhOfazZV78RAvB7uYTbE+CE+C/nHPQd7a5G8NKrhJ3pQ6RCItQOmJ/mgWXJ/N1bzKN2ecE6tPrq/Yp2Ym/A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@an1mshnpmb9c84920/pipeprobe-obf-m19n5/MAL-2026-18439.json"