MAL-2026-4423

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@refactco/refact-os/MAL-2026-4423.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4423
Withdrawn
2026-05-26T21:41:23Z
Published
2026-05-25T04:23:38Z
Modified
2026-05-27T00:32:02Z
Summary
Malicious code in @refactco/refact-os (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (072881a1fd9241acfcd601ad5387b0338a26ff4828763658c3840b43a3cedb1c)

Running this package's refact-os init CLI scaffolds AI-editor hook configurations (.claude/settings.json, .cursor/hooks.json) and copies two Python hooks (templates/base/agent/hooks/claude-sync-transcript.py, templates/base/agent/hooks/send-transcript-to-remote-server.py) into the user's project. The Cursor hooks register on beforeSubmitPrompt and afterAgentResponse, and the Claude hook fires on SessionEnd. After scaffolding, every user prompt, every assistant response, and the full per-session JSONL transcript — together with git remote URL and OS hostname/user — are POSTed to https://159.223.97.72:8443/transcript, a hardcoded public DigitalOcean IPv4 address. TLS certificate verification is explicitly disabled (ctx.check_hostname = False; ctx.verify_mode = ssl.CERT_NONE). Source comments describe the destination as a 'self-signed cert on loopback' / 'loopback / controlled endpoints only', but 159.223.97.72 is not a loopback address — it is publicly routable. The README advertises the package as an 'agent-first repo standard' / folder-layout scaffolder and does not disclose any transcript upload. Once installed and used as documented, every AI chat session — including source code, secrets pasted in prompts, and internal documentation — is silently forwarded to an author-controlled remote IP without consent and without TLS validation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004580",
            "import_time": "2026-05-26T05:52:52.807725319Z",
            "modified_time": "2026-05-25T04:23:38Z",
            "sha256": "072881a1fd9241acfcd601ad5387b0338a26ff4828763658c3840b43a3cedb1c",
            "source": "amazon-inspector",
            "versions": [
                "1.5.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004581",
            "import_time": "2026-05-26T05:52:52.902668047Z",
            "modified_time": "2026-05-25T04:59:21Z",
            "sha256": "4ac0cf32ff1147655976338fa4e99b9b56b412fd5a0299b932c7f84d95150379",
            "source": "amazon-inspector",
            "versions": [
                "1.5.2"
            ]
        },
        {
            "id": "IN-MAL-2026-004871",
            "import_time": "2026-05-26T09:17:32.287920813Z",
            "modified_time": "2026-05-26T08:28:00Z",
            "sha256": "c80a2076f29e220293219b51216f61f71274d4b49cdcb8590d05e4071e1722e2",
            "source": "amazon-inspector",
            "versions": [
                "1.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004923",
            "import_time": "2026-05-26T15:07:43.410756138Z",
            "modified_time": "2026-05-26T14:48:26Z",
            "sha256": "55c92841bffd38db4a5ebc67cf4ce3c7f580446074ed5e93864d837e5b7f24d0",
            "source": "amazon-inspector",
            "versions": [
                "1.6.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @refactco/refact-os

Package

Name
@refactco/refact-os
View open source insights on deps.dev
Purl
pkg:npm/%40refactco%2Frefact-os

Affected ranges

Affected versions

1.*
1.5.0
1.5.2
1.6.0
1.6.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "templates/base/agent/hooks/claude-sync-transcript.py",
            "sha256": "f122221d733fa206df07da3f4e314919138847406760ecfaf02de209e79e45f9",
            "tlsh": "57029425bd1e9433c3e3c22880b9c4552739e9073705a834baddc6991f8daf9c5b46de"
        },
        {
            "path": "templates/base/agent/hooks.json",
            "sha256": "f982098e8f2eaeb328707b95d8daa23c3d50d77f9dc7f143d0b0f168a718a78d",
            "tlsh": "a501a4aee8e9085318d1353847fd54405aecf44b1b99bc02779f481d4f19a9e6ea00fb"
        }
    ],
    "package_integrity": [
        {
            "filename": "refact-os-1.5.0.tgz",
            "hashes": {
                "sha1": "f5b6527dabefc8fb7705602208c2dac9ed8b20fc",
                "sha512_sri": "sha512-NpmgUfqXU276qGBwO9KLRKzEiVa8SqH7D8XXrVegulOmSnJqo4rS/1MeTffi5LWNht6WKIFC7dAUGzWtf789ig=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@refactco/refact-os/MAL-2026-4423.json"