MAL-2026-4692

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thevoid/MAL-2026-4692.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4692
Published
2026-05-22T16:40:24Z
Modified
2026-05-26T06:02:40Z
Summary
Malicious code in thevoid (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ce4d125de5d699da897d074134f8d1f0a971aa23d9c3d6ff3330015fccad091)

On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage. This matches the canonical hardcoded-C2 exfiltration shape: a lifecycle script (postinstall.js line 38) issues https.get to a hardcoded attacker-controlled host (void-relay.com, line 22) with environment data attached. Any developer or CI runner that installs this package will leak its environment (which routinely contains API tokens, cloud credentials, and CI secrets) to the attacker.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004259",
            "import_time": "2026-05-26T05:52:15.187319709Z",
            "modified_time": "2026-05-22T20:44:35Z",
            "sha256": "0ce4d125de5d699da897d074134f8d1f0a971aa23d9c3d6ff3330015fccad091",
            "source": "amazon-inspector",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "id": "IN-MAL-2026-004260",
            "import_time": "2026-05-26T05:52:15.321549529Z",
            "modified_time": "2026-05-22T20:44:35Z",
            "sha256": "27287e9af97748818989eb46a4435e8684d75760a428b8d9054f080bfd1fa660",
            "source": "amazon-inspector",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "id": "IN-MAL-2026-004228",
            "import_time": "2026-05-26T05:52:11.740289221Z",
            "modified_time": "2026-05-22T16:40:25Z",
            "sha256": "47489953ce40d6c0f085ec6baf20a035de70f73694d6b8be5025d63c82205886",
            "source": "amazon-inspector",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-004227",
            "import_time": "2026-05-26T05:52:11.645713034Z",
            "modified_time": "2026-05-22T16:40:24Z",
            "sha256": "5c620020be938a746e20906905f09b52960636a2c53c649f64c9971257b655e9",
            "source": "amazon-inspector",
            "versions": [
                "0.1.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / thevoid

Package

Name
thevoid
View open source insights on deps.dev
Purl
pkg:npm/thevoid

Affected ranges

Affected versions

0.*
0.1.3
0.1.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "void-relay.com",
        "github.com",
        "release-assets.githubusercontent.com"
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "97f3da706360cb68e608de85d9c16b85fddc0cb2c365936b4c9e25c95228164d",
            "tlsh": "6c6185cd06f6623507b192a5851f896be77694123116da80f23d32a47fc2178c633afe"
        }
    ],
    "package_integrity": [
        {
            "filename": "thevoid-0.1.4.tgz",
            "hashes": {
                "sha1": "6c430076768eb5946400bf6af1dd8b5d57969a78",
                "sha512_sri": "sha512-oOQ/a3RC6j8Qaw/ADDqQMcn5Nqra1I5SDU0iHDvPKutLD0goAMed7yMDPwvIS701DAUvMApLtxV9WTmUCeoirQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thevoid/MAL-2026-4692.json"