MAL-2026-4266

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discovery-build/MAL-2026-4266.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4266
Published
2026-05-23T15:56:25Z
Modified
2026-05-26T06:02:30Z
Summary
Malicious code in discovery-build (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c24a1e59b8c5d3ae1059499825bf47d1abe8d362ddefe264f1a429ed9e7e98cc)

package.json declares scripts.postinstall=node postinstall.js, which executes unconditionally on npm install. The script collects host identifiers (os.hostname(), os.platform(), username, cwd), reads /etc/passwd via fs.readFileSync('/etc/passwd','utf8'), and bulk-enumerates the installer's environment variables (Object.entries(process.env).slice(0, 30)) — capturing whatever CI tokens, AWS credentials, npm tokens, or other secrets happen to be in scope. The collected data is POSTed as JSON over HTTPS to bl0oxto4g54mptbwu8q8i1r0mrsjgg45.oastify.com, a Burp Collaborator out-of-band testing subdomain controlled by whoever generated the payload. The package's self-description as a 'security research canary' does not change installer-side impact: any developer or CI pipeline that installs this package leaks host identity, /etc/passwd, and a slice of environment secrets to an external host without consent.

Source: ossf-package-analysis (122f28edfb2fdddb4059785146e58b64540086c0df37ced45b5bbc9d2dff926a)

The OpenSSF Package Analysis project identified 'discovery-build' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-23T17:26:10.470314218Z",
            "modified_time": "2026-05-23T17:00:59Z",
            "sha256": "122f28edfb2fdddb4059785146e58b64540086c0df37ced45b5bbc9d2dff926a",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-05-23T17:26:10.578145807Z",
            "modified_time": "2026-05-23T17:18:07Z",
            "sha256": "6f76708e3ff014efa97162fa2278d96f886348d836b3478b81c8025a8831d175",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-004361",
            "import_time": "2026-05-26T05:52:26.990294393Z",
            "modified_time": "2026-05-23T16:16:39Z",
            "sha256": "0a14a42d0af8676cca2cf61f76d68c54cd26d272d999dc034afedc27dd1e572a",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-004365",
            "import_time": "2026-05-26T05:52:27.487855841Z",
            "modified_time": "2026-05-23T17:00:37Z",
            "sha256": "920fade0555e4d2637f9c27075d0731b8221d99cb64c6544f59bb21c9bcf7a78",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-004363",
            "import_time": "2026-05-26T05:52:27.21022477Z",
            "modified_time": "2026-05-23T16:19:53Z",
            "sha256": "a96284a15ff7e94835c6bde07e06b9693481ee82776aedf14e2c3a15ee738037",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-004368",
            "import_time": "2026-05-26T05:52:27.79362402Z",
            "modified_time": "2026-05-23T17:03:26Z",
            "sha256": "b119b3cfa5bbb801aeff6835b8dd7ac5f7f37c6a31f90f09b4804aa121750f20",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-004351",
            "import_time": "2026-05-26T05:52:25.804542925Z",
            "modified_time": "2026-05-23T15:56:25Z",
            "sha256": "c24a1e59b8c5d3ae1059499825bf47d1abe8d362ddefe264f1a429ed9e7e98cc",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004367",
            "import_time": "2026-05-26T05:52:27.693683251Z",
            "modified_time": "2026-05-23T17:03:26Z",
            "sha256": "d21d9aa255e209f19ceedc445ccd53c380a7375780c9df193217ed74099b1956",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-004366",
            "import_time": "2026-05-26T05:52:27.596775946Z",
            "modified_time": "2026-05-23T17:00:38Z",
            "sha256": "eb50290b5e0d715f1323ec943dd7aa02122bbe9b9172d945de70825f9cf89f75",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / discovery-build

Package

Name
discovery-build
View open source insights on deps.dev
Purl
pkg:npm/discovery-build

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "kf3xr2idaeyvj255ohkhcal9g0msasyh.oastify.com",
        "scan.kf3xr2idaeyvj255ohkhcal9g0msasyh.oastify.com"
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "120130f07c55a2ca5a55abcfa8bf2ae304aa451cecd9f6d690ca6d23494f344d",
            "tlsh": "fd0120f153f0e6b058e30dc0e66588167127e0003305b9e039ac92656b8aeb846f2cec"
        }
    ],
    "package_integrity": [
        {
            "filename": "discovery-build-1.0.1.tgz",
            "hashes": {
                "sha1": "a1686ed8ee5e85181fd9dc4ad9de2f0f66db6a8e",
                "sha512_sri": "sha512-rCxHaZeLVx0J+Tux/KlFxdc1zEuzA/Uj50VS8QICKr5nWWRqE2yfSUodziqJnlAKJ52l6ZL+HiO/jesFwhzgfQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discovery-build/MAL-2026-4266.json"