MAL-2026-5297

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb-authflow/MAL-2026-5297.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5297
Published
2026-06-07T16:59:25Z
Modified
2026-06-12T20:01:49.479633987Z
Summary
Malicious code in consumerweb-authflow (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977)

On npm install, the package's postinstall.js collects host identifiers via os.hostname(), os.userInfo().username, os.platform(), and the current working directory, then POSTs them over HTTPS to kd1tbfhej84bcqde44rq77o79yfp3gr5.oastify.com (a Burp Collaborator out-of-band callback subdomain). The package's own metadata self-identifies as a dependency-confusion proof-of-concept (description: "Dependency confusion PoC - H1-lingtys", payload tag src: 'paypal-dep-confusion-poc'), and the package name is chosen to collide with an internal/private package name so that misconfigured resolvers pull this public version instead. Regardless of bug-bounty intent, every installer's machine identity is leaked to an external attacker-controlled OAST endpoint without consent, automatically, on a default install.

Source: ossf-package-analysis (0a4795bc3b2c513417e92b1547d165f9b6cbb750f437b5bf3ac87e63832087ca)

The OpenSSF Package Analysis project identified 'consumerweb-authflow' @ 4.1.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "import_time": "2026-06-07T17:33:24.34930144Z",
            "modified_time": "2026-06-07T16:59:25Z",
            "sha256": "0a4795bc3b2c513417e92b1547d165f9b6cbb750f437b5bf3ac87e63832087ca",
            "versions": [
                "4.1.1"
            ]
        },
        {
            "modified_time": "2026-06-07T17:35:34Z",
            "import_time": "2026-06-07T18:33:01.400688057Z",
            "source": "ossf-package-analysis",
            "sha256": "6046f90089681a0351528c2aec67d71ba49df4e2fb98bc7ce59206d3a9e02de1",
            "versions": [
                "4.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-005254",
            "modified_time": "2026-06-09T22:43:40Z",
            "import_time": "2026-06-09T23:32:25.412194835Z",
            "source": "amazon-inspector",
            "sha256": "1dfe3a6140cb37159a3f0284f9e5977fc40e3bfe77b7d320e1e13d5cb55e75c1",
            "versions": [
                "4.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005255",
            "modified_time": "2026-06-09T22:43:40Z",
            "import_time": "2026-06-09T23:32:25.472729184Z",
            "source": "amazon-inspector",
            "sha256": "ae33044ec0b4ed91962290dba48f2643d92a9b625fcaa44dfbd7701af7b2fe95",
            "versions": [
                "4.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-006176",
            "source": "amazon-inspector",
            "import_time": "2026-06-12T19:44:16.452737672Z",
            "modified_time": "2026-06-12T19:10:38Z",
            "sha256": "acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977",
            "versions": [
                "4.1.3"
            ]
        },
        {
            "id": "IN-MAL-2026-006177",
            "source": "amazon-inspector",
            "import_time": "2026-06-12T19:44:16.551990383Z",
            "modified_time": "2026-06-12T19:10:39Z",
            "sha256": "d166b1a62988a2bd5649488117723a04bed050087a94f0994bb8343f6642a8d7",
            "versions": [
                "4.1.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / consumerweb-authflow

Package

Name
consumerweb-authflow
View open source insights on deps.dev
Purl
pkg:npm/consumerweb-authflow

Affected ranges

Affected versions

4.*
4.1.1
4.1.3

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "consumerweb-authflow-4.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-eZf05XdyWCOf0Zu04EfP84uvX/Wzu+JQZ0maOgfn7apdJHb7ZmKGpTovUQwG3U2uaN3maa+v5+xakaX618oikg==",
                "sha1": "32b09884dcf5feb7b05befdc496d8b6b030c7dbe"
            }
        }
    ],
    "domains": [
        "kd1tbfhej84bcqde44rq77o79yfp3gr5.oastify.com"
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "60f08bf06271aa745fb991d8e0d498058173e150bc0bbce1bdc806a8abc9af815b4df4",
            "sha256": "9c1ee5a9da2f3c5d5a87a297d2cd64506644102fec6d0ed00de340bc96140ec3"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/consumerweb-authflow/MAL-2026-5297.json"