MAL-2026-6249

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/blinkit-core/MAL-2026-6249.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6249
Published
2026-06-21T16:21:08Z
Modified
2026-06-23T17:01:25.053455027Z
Summary
Malicious code in blinkit-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8)

On npm install, the package's preinstall lifecycle hook runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/ and POSTs the installer's hostname (hostname -f), current user (whoami), working directory, and a base64-encoded dump of the entire process environment (env | base64 -w0) — which on CI/build hosts routinely contains tokens, cloud credentials, and registry auth. The package itself is hollow: index.js only exports { name, version } and provides no functionality. The repository.url claims git+https://github.com/zomato/blinkit-core.git while publishing under that internal-sounding name on the public registry, matching the canonical dependency-confusion attacker shape against Zomato's internal blinkit-core namespace. Installer harm: any build pipeline that resolves this public package instead of an internal mirror leaks host identity and the full environment (including secrets) to the attacker's out-of-band interaction listener at install time, before any other code runs.

Source: ossf-package-analysis (304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15)

The OpenSSF Package Analysis project identified 'blinkit-core' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15",
            "import_time": "2026-06-21T16:38:03.090942785Z",
            "source": "ossf-package-analysis",
            "modified_time": "2026-06-21T16:21:08Z",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "sha256": "2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8",
            "import_time": "2026-06-23T16:54:12.249149923Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T16:00:45Z",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007258"
        }
    ]
}
References
Credits

Affected packages

npm / blinkit-core

Package

Name
blinkit-core
View open source insights on deps.dev
Purl
pkg:npm/blinkit-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/blinkit-core/MAL-2026-6249.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "22c96127b73579bc7e83350f8103221d2b73b0eaa6f58714ae3e2f5a366f1dc9",
            "tlsh": "0201c964793892733d8c4374f936002ab8b16f0f84742c04df9b011c434f715663ea27",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "blinkit-core-1.0.0.tgz",
            "hashes": {
                "sha1": "5b3f91486a814516afcca3e7a8a4f44ae6591183",
                "sha512_sri": "sha512-3OUMGcv04HfBHcYNX4ZckP+B+PiahD/UmgexEwgB3/yH00vPDFhUDyXm2uQxeBKdxwCEUwU27SLWI5rbstnlcQ=="
            }
        }
    ]
}