MAL-2026-6077

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ebpf-tracker-action/MAL-2026-6077.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6077
Published
2026-06-17T21:34:28Z
Modified
2026-06-17T22:01:48Z
Summary
Malicious code in ebpf-tracker-action (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f51f94366660f50b3ffaacedda1e956035ca8a7e5e0cadc33f2aefc20dd8a6a3)

package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname (os.hostname()), username (os.userInfo()), homedir, DNS servers, and package paths, reads /etc/passwd and /etc/hosts via fs.readFileSync, and HTTPS-POSTs the JSON payload to 66az91mywqmmbqau9k79bum1us0jo9cy.oastify.com (a Burp Collaborator subdomain). Package metadata (empty author, empty description, generic CI-flavored name ebpf-tracker-action) is consistent with a dependency-confusion attack targeting an internal package name. Any machine that installs this package leaks system identity and local account data to an attacker-controlled host at install time.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-006942",
            "import_time":  "2026-06-17T21:42:17.972244744Z",
            "modified_time":  "2026-06-17T21:34:28Z",
            "sha256":  "f51f94366660f50b3ffaacedda1e956035ca8a7e5e0cadc33f2aefc20dd8a6a3",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ebpf-tracker-action

Package

Name
ebpf-tracker-action
View open source insights on deps.dev
Purl
pkg:npm/ebpf-tracker-action

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "dea7234043007dd10c8e4f878d02284b1b7aaefa24812438461717cd4b9b3b8c",
            "tlsh":  "c741139592da17330dd210c0660c70852359f977725998d076df42969f869f8b7316f3"
        },
        {
            "path":  "package.json",
            "sha256":  "9aed9e65afa8e3e6fac2cf61d06252d7918346fb384f339ca08c3884d35e022b",
            "tlsh":  "a7d0a7304d62693325c506660c3b959772718f2f14147c08a7cb182c81de6b798ff35c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ebpf-tracker-action-1.0.1.tgz",
            "hashes":  {
                "sha1":  "845c5488bd5d7898ccb97acf9d391ebebff0035f",
                "sha512_sri":  "sha512-F7BStV9yS4vt6PfZB7fjGIhxZTtSXOp/wtCAQiUO1B18nJpBShKoAISnI9C5Rx+AuNQ69KkQyZuuud+5nlp3rw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ebpf-tracker-action/MAL-2026-6077.json"