MAL-2026-5460

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fhirproxy/MAL-2026-5460.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5460
Published
2026-06-09T18:03:37Z
Modified
2026-06-09T19:01:27.893700649Z
Summary
Malicious code in fhirproxy (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (96e092973bad8e995bdec34000e45943e0be59996e84f181ee4bee9cd423f8eb)

fhirproxy@90.0.0 is a thin loader package whose only behavior is to pull and execute the dependency fhirproxy-utils. package.json declares both preinstall and postinstall hooks that run node index.js, and index.js's only meaningful statement is require('fhirproxy-utils'). That dependency is fetched from npm at install time and its top-level code runs on the installer's machine during npm install without further user interaction. The package additionally claims a bin map that aliases the names of widely used developer tools — webpack, webpackcli, vite, eslint, jest, tsc, tsnode, prettier, next, nodemon, turbo — all pointing at the same index.js. Once installed, node_modules/.bin/<tool> resolves to this package, so any subsequent invocation of those commands in the project (CI builds, local dev scripts) re-executes index.js and re-loads fhirproxy-utils instead of the genuine tool. The package presents itself as OpenMRS REST tooling (author: "OpenMRS Community Contributor", version 90.0.0, 351-byte stub printing [+] OpenMRS REST Utilities Subsystem Initialized.), but real OpenMRS packages are scoped under @openmrs/* and published by named maintainers — this is impersonation, not a real OpenMRS project. The combination of impersonation metadata, lifecycle-hook execution of an opaque dependency, and bin-hijacking of common dev tooling forces installer-side execution of attacker-controlled code at install time and on every subsequent invocation of any hijacked tool name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-06-09T18:03:37Z",
            "versions": [
                "90.0.0"
            ],
            "sha256": "96e092973bad8e995bdec34000e45943e0be59996e84f181ee4bee9cd423f8eb",
            "id": "IN-MAL-2026-005165",
            "source": "amazon-inspector",
            "import_time": "2026-06-09T18:50:21.530900267Z"
        },
        {
            "modified_time": "2026-06-09T18:03:38Z",
            "versions": [
                "90.0.0"
            ],
            "sha256": "f10d16da1fb5b7ed2d0dc07f015466cee8f7b2ba9c118ac7c6989c717ac3dd62",
            "id": "IN-MAL-2026-005166",
            "source": "amazon-inspector",
            "import_time": "2026-06-09T18:50:21.636983641Z"
        }
    ]
}
References
Credits

Affected packages

npm / fhirproxy

Package

Name
fhirproxy
View open source insights on deps.dev
Purl
pkg:npm/fhirproxy

Affected ranges

Affected versions

90.*
90.0.0

Database specific

indicators 
{
    "domains": [
        "kubernetes.default.svc.cluster.local",
        "ec2.internal",
        "active-directory.local",
        "gitlab.local",
        "redis.internal",
        "lan",
        "internal.jira.local",
        "gitlab.internal",
        "mongodb.internal",
        "internal",
        "intranet.local",
        "momo-rest.lapxa354.workers.dev",
        "azure.internal",
        "consul.service.consul",
        "kubernetes.default",
        "kubernetes.default.svc",
        "jenkins.local",
        "istio-ingressgateway.istio-system.svc.cluster.local",
        "redis.local",
        "db.local",
        "rancher.internal",
        "google.internal",
        "corp.local",
        "vault.internal",
        "compute.internal",
        "jenkins.internal",
        "postgres.local",
        "home"
    ],
    "evidence_files": [
        {
            "sha256": "0a3942d11c34f007711d953ad6bd751a8df78df45873b9aa337e63f59f982062",
            "tlsh": "25e0c693fada31618228fa63a57e0214f5f6beca03014cdfb03484262f30c888082ce8",
            "path": "index.js"
        },
        {
            "sha256": "d0e15d33ff072dd0a54e8f100fb3d90a608f7ca49726627df051e7383f5aa581",
            "tlsh": "7711c633daa25e230178db95a96a0e55f0d34b3f2021080bb6bd102d8ff355294ceb59",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-6pnB2Ms6NHy7b4XXrekTj1B/jfzQCnNAENMw4pllE+M9QDntfogYSzLOohl0FlexmFfiSvus05l74Apr8y4ozQ==",
                "sha1": "0697afe8f60c10b9184148c2d9ec485a8cd19350"
            },
            "filename": "fhirproxy-90.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fhirproxy/MAL-2026-5460.json"