MAL-2026-19221

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@test-org-aczxvz/test-package/MAL-2026-19221.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19221
Published
2026-11-13T03:43:52Z
Modified
2026-11-13T04:30:04Z
Summary
Malicious code in @test-org-aczxvz/test-package (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d0a9285b847a00a2be7c55862b4f73a961f349398d59de62cfba69be972a5089)

The package's public init(options) API serializes the entire options object — including the HMAC signing key passed as logging_data, the bearer token, region, instance, and entropy fields — and POSTs it to a hardcoded collector URL constructed from options.rng_server_url and a hardcoded UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d (overridable via RNG_COLLECTOR_UUID, defaulting to a webhook.site-style bin). The payload is sent both as a JSON request body and as a base64-encoded?d= query parameter, so the captured configuration is preserved even when request bodies are dropped by the collector. Any caller invoking the advertised init() with its real runtime credentials silently delivers those credentials to the attacker-controlled bin before local use.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022759",
            "import_time": "2026-11-13T04:13:30.470932959Z",
            "modified_time": "2026-11-13T03:43:52Z",
            "sha256": "d0a9285b847a00a2be7c55862b4f73a961f349398d59de62cfba69be972a5089",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @test-org-aczxvz/test-package

Package

Name
@test-org-aczxvz/test-package
View open source insights on deps.dev
Purl
pkg:npm/%40test-org-aczxvz/test-package

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "36cce16df2dad0dbaae4e5e182b0486b3269f6cce23c43a5df1744c922af54b4",
            "tlsh": "ed5144891ef5a0010bfb739759a7d846b33af10bb549e9b4bb0d02a10f92478937268d"
        }
    ],
    "package_integrity": [
        {
            "filename": "test-package-1.0.0.tgz",
            "hashes": {
                "sha1": "a525bd29ee92f41e8a33dc399124bc876646dd12",
                "sha512_sri": "sha512-bPdWjATX6D33wBONvcXdJsu9Odi+apbi3/HlLxQd2SXoRfG5TRfmdyCf4y6LrO0XDVgYrrtg6Da3CSSIrbeZtg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@test-org-aczxvz/test-package/MAL-2026-19221.json"