MAL-2026-18449

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ms-client-portal/MAL-2026-18449.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18449
Published
2026-10-31T13:10:23Z
Modified
2026-11-02T05:45:05Z
Summary
Malicious code in ms-client-portal (npm)
Details

ms-client-portal is a dependency-confusion package with no functional code; its README says the name is an internal project name exposed in the production web bundle of a health-sector client portal. Its preinstall and postinstall scripts each run a node -e one-liner on npm install that sends an HTTP GET to http://38.242.235.206/depconf/ms-client-portal/preinstall (and /postinstall) with the user name (USER or USERNAME), hostname and working directory in the query string. The npm account amahrou1a published versions 1.0.0 and 10.0.0 on 2026-10-31, and earlier the same day two more packages, internal-renderers and pandafortunerush, with the same beacon to the same server.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "4e69a9ec1b1080488719673e44b4b5652d0b2ee55cefa61aa0ea1d0b18b9ddd7"
                },
                "note":  "preinstall and postinstall send the user name, hostname and working directory to 38.242.235.206 (ms-client-portal@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "1760f11a7252576717913388ed01e169649f477ed238fd361356356d1a99aa77"
                },
                "note":  "preinstall and postinstall send the user name, hostname and working directory to 38.242.235.206 (ms-client-portal@10.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "ips":  [
            "38.242.235.206"
        ],
        "urls":  [
            "http://38.242.235.206/depconf/ms-client-portal/preinstall",
            "http://38.242.235.206/depconf/ms-client-portal/postinstall"
        ]
    }
}
References
Credits

Affected packages

npm / ms-client-portal

Package

Name
ms-client-portal
View open source insights on deps.dev
Purl
pkg:npm/ms-client-portal

Affected ranges

Affected versions

1.*
1.0.0
10.*
10.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ms-client-portal/MAL-2026-18449.json"