MAL-2026-4684

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tdpilot/MAL-2026-4684.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4684
Withdrawn
2026-05-26T17:39:02Z
Published
2026-05-20T07:37:35Z
Modified
2026-05-27T00:32:08Z
Summary
Malicious code in tdpilot (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (92ebe5ca10c51471256249507d8c7b142996cc72d7472a7a55c08fe6351876f9)

run.js invokes execSync("curl -LsSf https://astral.sh/uv/install.sh | sh"), fetching and executing a remote shell script from astral.sh without integrity verification. While astral.sh is the legitimate publisher of the uv Python package manager, piping a remote script directly into sh from within an npm package is an install-time-RCE pattern: the fetched content is mutable, unpinned, and runs with the user's privileges, modifying the user's environment (typically writing to ~/.local/bin, ~/.cargo/, and shell RC files) as a side effect of using this package. Any compromise of the install.sh endpoint or DNS for astral.sh would yield arbitrary code execution on every machine running this package. The package does not verify a hash or signature, does not pin a version of uv, and does not gate the install behind explicit user consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003494",
            "import_time": "2026-05-26T05:50:43.933836267Z",
            "modified_time": "2026-05-20T07:37:35Z",
            "sha256": "3cd5d23e40cb3c5bc3573930069cc8877d39a392a6c51093212706cb2c51f542",
            "source": "amazon-inspector",
            "versions": [
                "1.6.15"
            ]
        },
        {
            "id": "IN-MAL-2026-003605",
            "import_time": "2026-05-26T05:50:57.209843492Z",
            "modified_time": "2026-05-20T19:35:52Z",
            "sha256": "92ebe5ca10c51471256249507d8c7b142996cc72d7472a7a55c08fe6351876f9",
            "source": "amazon-inspector",
            "versions": [
                "1.6.16"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tdpilot

Package

Name
tdpilot
View open source insights on deps.dev
Purl
pkg:npm/tdpilot

Affected ranges

Affected versions

1.*
1.6.15
1.6.16

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "run.js",
            "sha256": "db3bf1f2d651e4e5ced78eeb27cfc989667707059ab4de918ba2feac38c04ca6",
            "tlsh": "5de1716a02e505353976c66c970b0021629ab2173b06ec52b5af32685fde53882337fe"
        }
    ],
    "package_integrity": [
        {
            "filename": "tdpilot-1.6.15.tgz",
            "hashes": {
                "sha1": "95442df5d1364628b99125676d0c9243afbe467a",
                "sha512_sri": "sha512-3Rnlv+mS/CgpVo+5tyCNZNQvea1/z9d4H8dgzYgUWCueTVbU5K+Hc86HLjSZijyKjLpyckUj1KnslMY9xxWuNw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/tdpilot/MAL-2026-4684.json"