MAL-2026-6253

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zomato-server/MAL-2026-6253.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6253
Published
2026-06-21T16:04:03Z
Modified
2026-06-22T18:31:22.787014326Z
Summary
Malicious code in zomato-server (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f0a12373009dd17131e45f4d20570904f2b8074367ee8b121e60a3ce5764fa00)

The package's package.json declares a preinstall lifecycle hook that runs curl to POST the installer's hostname, whoami, current working directory, and a base64-encoded dump of the full process environment to http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site over plain HTTP. The destination is an Interactsh-style out-of-band collection subdomain unrelated to any legitimate Zomato infrastructure. This fires automatically on npm install without user consent, leaking any credentials, tokens, or secrets present in environment variables (CI tokens, npm auth, AWS keys, etc.). The package itself ships only a 62-byte stub index.js exporting { name, version } and impersonates the Zomato brand (description 'Zomato server-side utilities', repo pointing at github.com/zomato/zomato-server), consistent with a dependency-confusion lure targeting Zomato internal builds.

Source: ossf-package-analysis (f8a4a2681c8fa36379b138cad816cffb627b9e8095e5fe3cbd5a144075efe1da)

The OpenSSF Package Analysis project identified 'zomato-server' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f8a4a2681c8fa36379b138cad816cffb627b9e8095e5fe3cbd5a144075efe1da",
            "import_time": "2026-06-21T16:38:02.860619598Z",
            "modified_time": "2026-06-21T16:04:03Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "f0a12373009dd17131e45f4d20570904f2b8074367ee8b121e60a3ce5764fa00",
            "import_time": "2026-06-22T18:25:28.886188488Z",
            "modified_time": "2026-06-22T17:42:30Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007148"
        }
    ]
}
References
Credits

Affected packages

npm / zomato-server

Package

Name
zomato-server
View open source insights on deps.dev
Purl
pkg:npm/zomato-server

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "zomato-server-1.0.0.tgz",
            "hashes": {
                "sha1": "40f30b3393c7e50716df06149ee32553b379c4f0",
                "sha512_sri": "sha512-V8dfW3BMzzGkA/5syLmC11FzVQvsKEFQKijBPCuLG/5C5GxvzB/19ZEhFW+mJ4BpqPg923Pba/k2mnPUUJoZ5w=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "ee01bd25b834d6737d8c4771bd66206a3e692f4f84346c045f9f011e838f215227e662",
            "sha256": "b9028dfb3b4140b2d87815f6feb5d4f0232a5df2ef1fcb90f12b185f54bbccd6",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zomato-server/MAL-2026-6253.json"