MAL-2026-5570

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nim-submit-for-test/MAL-2026-5570.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5570
Published
2026-06-11T04:46:02Z
Modified
2026-06-11T05:46:31Z
Summary
Malicious code in nim-submit-for-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2bf75301042574897cc2f4bd8f3b8939fe4ac7a958f2cfe2404bbbee149797d0)

On npm install, the package's postinstall hook executes lib/_compiler.js, which spawns a detached Node process that collects host identity (hostname, username, cwd, IP addresses, npm registry) and the names of environment variables matching NPM|NODE|CI|JENKINS|GIT|BUILD|RUNNER|DOCKER|KUBE|REGISTRY, then POSTs them via https.request to a hardcoded DingTalk webhook (oapi.dingtalk.com/robot/send) with an embedded access token. Before sending, the script checks the installer's username and hostname against an evasion list ('sandbox','malware','analyst','cuckoo','analysis','sample') and exits silently when matched, to avoid running in security analysis environments. The combination of automatic install-time execution, host/CI metadata collection, hardcoded attacker-controlled webhook, and analyst-environment evasion is a clear supply-chain exfiltration beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005471",
            "import_time": "2026-06-11T05:40:58.188983343Z",
            "modified_time": "2026-06-11T04:46:02Z",
            "sha256": "2bf75301042574897cc2f4bd8f3b8939fe4ac7a958f2cfe2404bbbee149797d0",
            "source": "amazon-inspector",
            "versions": [
                "2.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-005472",
            "import_time": "2026-06-11T05:40:58.261937784Z",
            "modified_time": "2026-06-11T04:46:03Z",
            "sha256": "77bfef43e57cee7068599b0d1af2fd6b5400e7298aa9833fdffda514a28eeeb2",
            "source": "amazon-inspector",
            "versions": [
                "2.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nim-submit-for-test

Package

Name
nim-submit-for-test
View open source insights on deps.dev
Purl
pkg:npm/nim-submit-for-test

Affected ranges

Affected versions

2.*
2.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "oapi.dingtalk.com"
    ],
    "evidence_files": [
        {
            "path": "lib/_compiler.js",
            "sha256": "bd158e2c3e12c1c3661649a5215fafec97c606984dd005a76cc43df7c120d80d",
            "tlsh": "d741b5e674a97638177c85c290821016da57e2223583f8e0fc2c41d61bc7cfa9af197e"
        }
    ],
    "package_integrity": [
        {
            "filename": "nim-submit-for-test-2.2.0.tgz",
            "hashes": {
                "sha1": "6cefc3a4fe0e36e4eb878b1ef208dff76fd6dbe9",
                "sha512_sri": "sha512-YJEPRf1iGYTnLiuGLOghEE4tUovXmi9ygxEr+ZsT3bwJELWergDWHrr0x6lWczjuY9/eT4OE+uuAJ8RXcHdRtA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nim-submit-for-test/MAL-2026-5570.json"