MAL-2026-4804

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@leviyuan/lodestar/MAL-2026-4804.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4804
Withdrawn
2026-05-26T18:19:24Z
Published
2026-05-26T10:17:39Z
Modified
2026-05-27T00:31:59Z
Summary
Malicious code in @leviyuan/lodestar (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba)

The package ships a lifecycle-invoked script (dist/lodestar-setup.js) that performs an HTTP POST to a hardcoded https://open.feishu.cn endpoint, with process.env data referenced in the same file. dist/lodestar.js similarly contains multiple POST calls to the same Feishu infrastructure. The hardcoded third-party C2 destination (Feishu's open API, used as a webhook receiver) combined with environment-variable access is the canonical exfiltration shape: any developer or build system that installs this package will leak environment contents to the publisher's webhook. The package name (@leviyuan/lodestar) is also a scoped lookalike of the well-known Ethereum consensus client 'lodestar' from ChainSafe, which compounds the supply-chain risk by inviting confused installs.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004895",
            "import_time": "2026-05-26T13:32:45.910447663Z",
            "modified_time": "2026-05-26T10:17:39Z",
            "sha256": "8c295b3a16fad72f7b165d049e75feb88883dcc1b5b8d9d72b52ac7b40aa09ba",
            "source": "amazon-inspector",
            "versions": [
                "0.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @leviyuan/lodestar

Package

Name
@leviyuan/lodestar
View open source insights on deps.dev
Purl
pkg:npm/%40leviyuan%2Flodestar

Affected ranges

Affected versions

0.*
0.4.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/lodestar-setup.js",
            "sha256": "37d129b83725e1c424b265bcaefde298b81fa1c4a1af1c18230bca4d9b7768b2",
            "tlsh": "9e424f58baec99743fae50acedc00117e1940e086e28e52671fd746e37f4a589ec273d"
        },
        {
            "path": "dist/lodestar.js",
            "sha256": "6ccca47579af6376d028df911f153b4d10036a8a60ab8d5d417266728c3d076e",
            "tlsh": "c18598e6ee1ef4514dbce561ebb32a506322f848b806105affd84cdbd298e44f1d6934"
        }
    ],
    "package_integrity": [
        {
            "filename": "lodestar-0.4.2.tgz",
            "hashes": {
                "sha1": "7cb744818def683ce70b7c4df9446cd4f03e66db",
                "sha512_sri": "sha512-GbiV2JaLykqCZmEVkktMOEHRDcz2BcDzX+eyoR3fRmUFHrb/PVMzucIfWXQaVXxjSO49uzhBGnqsQiMY/75o2Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@leviyuan/lodestar/MAL-2026-4804.json"