MAL-2026-4683

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tax4all-components/MAL-2026-4683.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4683
Withdrawn
2026-05-26T22:13:04Z
Published
2026-05-23T01:25:37Z
Modified
2026-05-27T00:32:08Z
Summary
Malicious code in tax4all-components (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (411707aa243c516b714830da4805c4abacaa4d5f7e2e8959773cd93468dd78aa)

The exported ContactForm Vue component in deploy/dist/index.js hardcodes form submissions to https://formsubmit.co/ajax/joaofr.gg@gmail.com — the package author's personal Gmail address — with no prop or configuration option to override the destination. When a downstream application embeds this component, every submission (full name, phone number, corporate email, company name, Brazilian CNPJ tax ID, role, and message body) is POSTed to the author's mailbox instead of the integrating application's backend. Developers consuming a generic 'contact form' component reasonably expect submissions to go to their own server; the hardcoded destination causes silent exfiltration of end-user PII and business data through normal use of the advertised API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004278",
            "import_time": "2026-05-26T05:52:17.460506228Z",
            "modified_time": "2026-05-23T01:25:37Z",
            "sha256": "411707aa243c516b714830da4805c4abacaa4d5f7e2e8959773cd93468dd78aa",
            "source": "amazon-inspector",
            "versions": [
                "0.1.26"
            ]
        },
        {
            "id": "IN-MAL-2026-004279",
            "import_time": "2026-05-26T05:52:17.556999308Z",
            "modified_time": "2026-05-23T01:25:37Z",
            "sha256": "47f34817f497287eb0b8d17433ee528a9c0dea372cf03a863c23f426c60f7ce8",
            "source": "amazon-inspector",
            "versions": [
                "0.1.26"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tax4all-components

Package

Name
tax4all-components
View open source insights on deps.dev
Purl
pkg:npm/tax4all-components

Affected ranges

Affected versions

0.*
0.1.26

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "34.2.16.104.in-addr.arpa"
    ],
    "evidence_files": [
        {
            "path": "deploy/dist/index.js",
            "sha256": "0909bb9ff9c9a5a0fa2fc0a1ed0ba3dfb3ca7c5342f187ffd599defbe2acd7b8",
            "tlsh": "43334205a8f6187393a3f029666f4c0b7939030b9a897ca47add46585f5d83c93f37ac"
        }
    ],
    "package_integrity": [
        {
            "filename": "tax4all-components-0.1.26.tgz",
            "hashes": {
                "sha1": "e0b11873dbb4ce45296c8d3e7d0ebecfdb32e353",
                "sha512_sri": "sha512-B6kRIFA91BTIPJtzhWJFi1fNibpnUvVizsQouH2dgpiXkE/CJImyFjg/Bpd38BQ931uqxm86kFUZp3i9E+HeZg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tax4all-components/MAL-2026-4683.json"