MAL-2026-6131

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/computerrock-babel-preset-react-app/MAL-2026-6131.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6131
Published
2026-06-18T15:57:20Z
Modified
2026-06-18T17:16:46Z
Summary
Malicious code in computerrock-babel-preset-react-app (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa)

The package impersonates the well-known babel-preset-react-app under a fake org-style prefix and ships no Babel preset code. package.json declares "preinstall": "node index.js", which runs automatically on npm install. index.js collects hostname, platform, arch, homedir, username/uid/gid/shell, OS info, current working directory, and the output of whoami and id, then POSTs the JSON payload to a hardcoded https://0bccssrkeubggq24k750nrw0erki88wx.oastify.com/detox56 URL (a Burp Collaborator out-of-band exfiltration host). The package's only function is reconnaissance and exfiltration of installer-side identifiers to an attacker-controlled host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006983",
            "import_time": "2026-06-18T17:08:46.070286157Z",
            "modified_time": "2026-06-18T15:57:20Z",
            "sha256": "8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa",
            "source": "amazon-inspector",
            "versions": [
                "15.12.11"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / computerrock-babel-preset-react-app

Package

Name
computerrock-babel-preset-react-app
View open source insights on deps.dev
Purl
pkg:npm/computerrock-babel-preset-react-app

Affected ranges

Affected versions

15.*
15.12.11

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "d3f41fc423c557627870b6d381cd6900ba3f0bf28ee7771b29d3e4bd0eaa39ce",
            "tlsh": "745151c515fa5a241ba7b8494a4f9002a327e1033509ee55bfcc8740af9937c9bf0bf6"
        },
        {
            "path": "package.json",
            "sha256": "83c754ff85d33ba567a06a73a6b1e30bfac9608daad5ba17ed0a7985b3cfcff9",
            "tlsh": "37d02e308e21603369c102974c2a906362e18e2f01047c08e3cf582c818eabb98fe30d"
        }
    ],
    "package_integrity": [
        {
            "filename": "computerrock-babel-preset-react-app-15.12.11.tgz",
            "hashes": {
                "sha1": "dc99e8d84c6cd94f8704d30a5268de3ac35421e4",
                "sha512_sri": "sha512-5cslXNRIE7+gJBwf3Oo0pt9XJpr1TK4Gk+bw3dU01c9JEUxuXNfUnHRz6wCdAzMo7iqudFYx43KJjcpCQ23ueQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/computerrock-babel-preset-react-app/MAL-2026-6131.json"