MAL-2026-6252

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zomato-logger/MAL-2026-6252.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6252
Published
2026-06-21T16:11:10Z
Modified
2026-06-22T18:31:22.626345185Z
Summary
Malicious code in zomato-logger (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3dccb8b8b32337c2a257a763c273e03367ec07c904b5db0c07dbf514d546709d)

On npm install, the package's preinstall lifecycle script in package.json runs curl to POST the installer's hostname, current user (whoami), working directory, and the entire environment (base64-encoded env output) to http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/install/<base64-pkg> over plain HTTP. The destination is an Interactsh / oast.site out-of-band collaborator subdomain — infrastructure used to capture exfiltrated data from victim hosts. The package itself is a hollow stub (index.js exports only { name, version }), and the metadata (description: "Zomato logging library", repo URL git+https://github.com/zomato/zomato-logger.git) impersonates Zomato, consistent with a dependency-confusion attack targeting an org-internal package name. Any host that resolves and installs this package leaks every environment variable (including any CI secrets, tokens, and credentials present in the build environment) to the attacker.

Source: ossf-package-analysis (637e09431107722f9603562638df114fcb31994e21ead800ccd63a666f65bea3)

The OpenSSF Package Analysis project identified 'zomato-logger' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-21T16:38:02.926477946Z",
            "sha256": "637e09431107722f9603562638df114fcb31994e21ead800ccd63a666f65bea3",
            "versions": [
                "1.0.0"
            ],
            "source": "ossf-package-analysis",
            "modified_time": "2026-06-21T16:11:10Z"
        },
        {
            "import_time": "2026-06-22T18:25:28.525039494Z",
            "id": "IN-MAL-2026-007144",
            "sha256": "3dccb8b8b32337c2a257a763c273e03367ec07c904b5db0c07dbf514d546709d",
            "modified_time": "2026-06-22T17:42:27Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / zomato-logger

Package

Name
zomato-logger
View open source insights on deps.dev
Purl
pkg:npm/zomato-logger

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "b40189287a3896237d8c4670bd5605293c657f8f84356c045edb111e82cf215226f626",
            "sha256": "90b50c56b7ef712957f85e5fd0d8925b745a2825e7dffd42f4ff712483421ec9"
        }
    ],
    "package_integrity": [
        {
            "filename": "zomato-logger-1.0.0.tgz",
            "hashes": {
                "sha1": "57015126cc539add7fc1738bf32499fb72b75603",
                "sha512_sri": "sha512-jyTIli6O2+3yJxXICoR6XV9ZPL0qNo0Rj/Sw3zo63zUpLqDYQ7Kwey0BqBJ1nfO+igAN1U+VD6zbkDmuT5kd3A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zomato-logger/MAL-2026-6252.json"