MAL-2026-19220

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@securihackbot/depconf-flow-1792484611/MAL-2026-19220.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19220
Published
2026-11-13T03:44:30Z
Modified
2026-11-13T04:30:07Z
Summary
Malicious code in @securihackbot/depconf-flow-1792484611 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8)

Package publishes under the @securihackbot scope as a public dependency-confusion squat of an internal name. The declared postinstall script executes postinstall.js, which on npm install collects host identifiers (os.hostname(), USER/USERNAME, platform, arch, node version, package name, and a nonce), base64-encodes them, and sends them as a query parameter via plain-HTTP GET to a hardcoded bare-IP collector at http://34.143.131.27:18080/. A DNS-exfil fallback resolves NONCE-prefixed subdomains under a configured DNS suffix. The exfiltration fires automatically on install with no opt-in, and any build host whose resolver pulls this public tarball instead of an intended internal @securihackbot/* package will beacon host metadata to the hardcoded collector. The 'authorized research' framing in the README does not gate the behavior, which runs against any installer that resolves this version.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022762",
            "import_time": "2026-11-13T04:13:30.812537142Z",
            "modified_time": "2026-11-13T03:44:30Z",
            "sha256": "6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8",
            "source": "amazon-inspector",
            "versions": [
                "1.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @securihackbot/depconf-flow-1792484611

Package

Name
@securihackbot/depconf-flow-1792484611
View open source insights on deps.dev
Purl
pkg:npm/%40securihackbot/depconf-flow-1792484611

Affected ranges

Affected versions

1.*
1.2.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "c5291ef5c48b511fafa45c758778ebf480fac19b4af345a2532f374f842a01d5",
            "tlsh": "0841839943a8833009f017c1f46e58abe27bf275379228f3a92d101527a5c3066f71e3"
        },
        {
            "path": "README.md",
            "sha256": "5bf6f54abec58eebf24250b459bcf92bcde5be96b44861f6c2b647cc345b52f1",
            "tlsh": "2b11632b5406473215b8484bb23e1979cb3beaf8f4eb4a6368d9133062cc708a15f322"
        }
    ],
    "package_integrity": [
        {
            "filename": "depconf-flow-1792484611-1.2.1.tgz",
            "hashes": {
                "sha1": "ffe6b2295a3d0c7a2714c2f57a7c1faa7400aecb",
                "sha512_sri": "sha512-/g9VoRLW9vj+n8LmuBuChXC2VcpMR4W3V/6qfHj0LtY877YSdSF1Zmiuhrcs4YcjWo0JcyB+lsj7+nRcrMPrMg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@securihackbot/depconf-flow-1792484611/MAL-2026-19220.json"