MAL-2026-5417

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@klapp-sca/routes/MAL-2026-5417.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5417
Published
2026-06-09T17:35:47Z
Modified
2026-06-09T19:01:27Z
Summary
Malicious code in @klapp-sca/routes (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (495f510483f297a56d545e8555db20eb54569f904bfd71853e54a18d89812cb0)

package.json declares "preinstall": "node index.js || true", so on every npm install the bundled index.js runs automatically and collects os.hostname(), os.userInfo().username, __dirname, and process.cwd() into a JSON payload. The payload is hex-encoded into DNS labels and resolved against *.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (an Interactsh/Burp-Collaborator-style out-of-band DNS sink) and simultaneously POSTed to a hardcoded bare IP at http://172.201.213.59:9090/c. This is a classic install-time reconnaissance beacon: installer machine identity is leaked to attacker-controlled infrastructure without any consent or user action beyond installing the package. The package's stated 'security research' description does not change the impact — any installer that runs npm install has their hostname, username, and working-directory paths sent to third-party endpoints.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005077",
            "import_time": "2026-06-09T17:45:53.046415938Z",
            "modified_time": "2026-06-09T17:35:47Z",
            "sha256": "11ae6419c673fc32db76632ea472b0a5c4fdb0beff999d5e6cd8fc144abab562",
            "source": "amazon-inspector",
            "versions": [
                "99.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005076",
            "import_time": "2026-06-09T17:45:53.012672857Z",
            "modified_time": "2026-06-09T17:35:47Z",
            "sha256": "495f510483f297a56d545e8555db20eb54569f904bfd71853e54a18d89812cb0",
            "source": "amazon-inspector",
            "versions": [
                "99.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005155",
            "import_time": "2026-06-09T18:50:20.734099927Z",
            "modified_time": "2026-06-09T17:56:55Z",
            "sha256": "813b153ed59f9a72a56179d192cc44c350ee849ae13b02e6dd7ef36496fd9843",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-005154",
            "import_time": "2026-06-09T18:50:20.609600129Z",
            "modified_time": "2026-06-09T17:56:54Z",
            "sha256": "d896040967e9bedf9f3146daf8c14a5669d1cdb47b776a9b747d940be79c3c1e",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @klapp-sca/routes

Package

Name
@klapp-sca/routes
View open source insights on deps.dev
Purl
pkg:npm/%40klapp-sca%2Froutes

Affected ranges

Affected versions

99.*
99.0.0
99.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "7b2268223a227363616e2d663162373062343163346266222c2275223a22.7363616e222c2264223a222f686f6d652f7363616e2f6e6f64655f6d6f64.756c65732f406b6c6170702d7363612f726f75746573222c2263223a222f.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live"
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "bcf07e7256b008ece552b37047030f2158b716f33a457ebf0a3050b1974d4fe3",
            "tlsh": "83f041e161b0d0f98b708580bdc86a8493b3c652b00288f0dc0d0fcf06c28d05c76ae1"
        },
        {
            "path": "package.json",
            "sha256": "4a38501e831ae72159f7200052b4165637cef0e5f4288f19b2e9198f42eae850",
            "tlsh": "a0c0807c2d31b436176183f46d796c4cf1fdc61410d48d488fe6457454b1be8905e115"
        }
    ],
    "package_integrity": [
        {
            "filename": "routes-99.0.1.tgz",
            "hashes": {
                "sha1": "17e6606e34e4526991637c674335e4900207b0f2",
                "sha512_sri": "sha512-k58XPdHNrB4Gu9yAjc40fSqHvEgLpyanUKlvUfHezEHLCltndHWgMRMyLGppkElq72vXE1+CcAAN6ifm8jAKjQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@klapp-sca/routes/MAL-2026-5417.json"