MAL-2026-4391

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@gad360/apothem/MAL-2026-4391.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4391
Published
2026-05-21T00:51:45Z
Modified
2026-05-26T06:01:49Z
Summary
Malicious code in @gad360/apothem (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4f5e509ba6aa2f781391f03ff37ea8005440c1d1106391bdfa91abae06336ad3)

The package's package.json declares a postinstall hook ("postinstall": "node install.js") that runs install.js automatically on npm install. install.js requires fs, os, https, and child_process, reads environment variables and host metadata (process.env, process.platform, process.arch, os.tmpdir, fs.readFileSync), and issues an https.get to the hardcoded endpoint https://ahmedgad.com. The combination of a hardcoded non-publisher destination with environment/system reads inside a lifecycle script is the canonical install-time exfiltration shape. The destination is unrelated to any documented vendor SDK or runtime CDN, and there is no version pinning, hash verification, or build-from-source justification for the network call.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003662",
            "import_time": "2026-05-26T05:51:03.9384998Z",
            "modified_time": "2026-05-21T00:51:45Z",
            "sha256": "4f5e509ba6aa2f781391f03ff37ea8005440c1d1106391bdfa91abae06336ad3",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-003663",
            "import_time": "2026-05-26T05:51:04.038250214Z",
            "modified_time": "2026-05-21T00:51:46Z",
            "sha256": "ad5f5b336ec6522037b3042e4f0adf68e9cd2e0fb4d94789f9ef5b1bc158b912",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @gad360/apothem

Package

Name
@gad360/apothem
View open source insights on deps.dev
Purl
pkg:npm/%40gad360%2Fapothem

Affected ranges

Affected versions

1.*
1.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "github.com"
    ],
    "evidence_files": [
        {
            "path": "install.js",
            "sha256": "ecfa2c6da67a9edc50b3004271598e9821ee716ae200c05d4f72fca49ac98a8e",
            "tlsh": "8d81644e05f3523042f365e6d66ba216a80b448bf106dd48faec93456fd3460ce63bee"
        },
        {
            "path": "package.json",
            "sha256": "79242f7ee71d7a79194cbfd9a089b17fab6e0c72f831fb51eb43ef70b936bdef",
            "tlsh": "9c119e61d7b10d630ed839905c3b114aa92a09d78d44bc2db793a11c0f5f02f12be7ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "apothem-1.1.0.tgz",
            "hashes": {
                "sha1": "edd5a51e77c387d0989177ffc51c72842cb007ee",
                "sha512_sri": "sha512-UEohNZbKX/AgTao0vNr2oN2RV27bNVTBywwi7xmIUYwZ4hbgSUYoMVmTM1uPFNcnAaFMXuhObVDv8pFG9UMWpQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@gad360/apothem/MAL-2026-4391.json"