MAL-2026-5833

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yunxin-overmind-comment/MAL-2026-5833.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5833
Published
2026-06-15T20:11:26Z
Modified
2026-06-15T20:31:52Z
Summary
Malicious code in yunxin-overmind-comment (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc)

On npm install, the package's scripts.postinstall runs src/_postinstall.js, which spawns a detached Node child that collects the installer's hostname, username, platform/arch, cwd, Node version, npm registry, all non-internal IPv4 addresses, and the keys of environment variables matching /NPM|NODE|CI|JENKINS|GIT|BUILD|RUNNER|DOCKER|KUBE|REGISTRY/. The collected data is HTTPS-POSTed to a hardcoded DingTalk bot webhook (https://oapi.dingtalk.com/robot/send?access_token=4e5cb67f...df393). Before sending, the script checks the username and hostname against an analyst/sandbox keyword list (sandbox, malware, analyst, cuckoo, analysis, sample) and silently no-ops if any match — explicit anti-analysis evasion. The combination of automatic install-time execution, host/network reconnaissance scoped to CI/build runners, hardcoded attacker-controlled callback, and sandbox-evasion gating is the canonical dependency-confusion beacon shape. Installing this package leaks internal hostnames, IP topology, and CI/build environment fingerprints to the operator of the DingTalk webhook, enabling targeted follow-on attacks against the installer's internal infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006704",
            "import_time": "2026-06-15T20:14:29.574321648Z",
            "modified_time": "2026-06-15T20:11:26Z",
            "sha256": "57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / yunxin-overmind-comment

Package

Name
yunxin-overmind-comment
View open source insights on deps.dev
Purl
pkg:npm/yunxin-overmind-comment

Affected ranges

Affected versions

1.*
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/_postinstall.js",
            "sha256": "d74886e20adaab3cbdb25d8f54ed4ed3a7f22c1d48e0e7ad80a740be9a238a1b",
            "tlsh": "da41b5e675a57638177c85c290821016da67e2223583f8e0fc2c41d61bc7cfa9af193e"
        }
    ],
    "package_integrity": [
        {
            "filename": "yunxin-overmind-comment-1.2.0.tgz",
            "hashes": {
                "sha1": "3b76dd6b1b7ee4100b68bd16e51331383cd85765",
                "sha512_sri": "sha512-K6rMksJ/7gEdo+1pn238nUYBxfFvStI+Q+P6Z0DKlz79wi3obd2o5ZOY4lPfE8owEvse++PoEJYGh3faQkvvCA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yunxin-overmind-comment/MAL-2026-5833.json"