MAL-2026-6238

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-client/MAL-2026-6238.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6238
Published
2026-06-20T13:10:03Z
Modified
2026-06-20T13:46:43Z
Summary
Malicious code in atlasora-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5)

package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https, fs, os, and child_process; collects host identifiers via os.hostname() and os.userInfo(); invokes execSync() to gather additional system data; checks for sensitive files via fs.existsSync(); and POSTs the collected data over an https.request() to a hardcoded remote endpoint. This is the canonical install-time system-information exfiltration shape: any developer or CI machine that runs npm install atlasora-client will silently leak host identity, user account info, and reconnaissance data about local filesystem contents to an attacker-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007094",
            "import_time": "2026-06-20T13:37:51.004020105Z",
            "modified_time": "2026-06-20T13:10:03Z",
            "sha256": "fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / atlasora-client

Package

Name
atlasora-client
View open source insights on deps.dev
Purl
pkg:npm/atlasora-client

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "install.js",
            "sha256": "5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88",
            "tlsh": "887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff"
        },
        {
            "path": "package.json",
            "sha256": "782c26c852740ff7a2ab03dceb60018bc24307b521ea586bd3f2fca78a7462ba",
            "tlsh": "e4e0e5706e2088735ac9a6ad8da6914676314e0bc4487c1d3ac7205c97de6320afda2d"
        }
    ],
    "package_integrity": [
        {
            "filename": "atlasora-client-1.0.0.tgz",
            "hashes": {
                "sha1": "631a9607e1d5033651ecb4f83e881492bbc5e1fe",
                "sha512_sri": "sha512-NnpCy9feNH/GeZ6NhBofP5lwWroCNIN0CMqeu8saHJmYe0EHlvdSmFpXZRAOhpP60oNF6F4TFqq14r3OXYF9JQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-client/MAL-2026-6238.json"