MAL-2026-6263

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gd-auth-client/MAL-2026-6263.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6263
Published
2026-06-22T16:26:57Z
Modified
2026-06-22T16:46:23.777379355Z
Summary
Malicious code in gd-auth-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4de00613e21b42bf3c651995beae63ff9d85772b9370145152d172a062be4fb7)

package.json declares preinstall: node index.js, which runs automatically on npm install. index.js requires os, dns, https, querystring, and the local package.json, then collects installer host identifiers — homedir (os.homedir()), hostname (os.hostname()), username (os.userInfo().username), configured DNS servers (dns.getServers()), current working directory (__dirname), and the full package.json contents — and POSTs them via HTTPS to 6pwzxcku93yjz1m1mp1ctzofj6pxdn1c.oastify.com/dependency-confusion, a Burp Collaborator (OAST) subdomain controlled by the publisher. The version number 999.0.0 combined with a generic, unscoped name is the standard dependency-confusion shape: the package is published to the public registry to win resolution against an internal/private package of the same name in a victim's build, at which point the preinstall hook beacons home with environment fingerprints suitable for follow-up targeting. Any developer or CI system that resolves this package suffers immediate exfiltration of host identity to an attacker-controlled endpoint at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4de00613e21b42bf3c651995beae63ff9d85772b9370145152d172a062be4fb7",
            "id": "IN-MAL-2026-007106",
            "modified_time": "2026-06-22T16:26:57Z",
            "source": "amazon-inspector",
            "import_time": "2026-06-22T16:36:58.565120185Z",
            "versions": [
                "999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gd-auth-client

Package

Name
gd-auth-client
View open source insights on deps.dev
Purl
pkg:npm/gd-auth-client

Affected ranges

Affected versions

999.*
999.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "7da3dca20f9c2c55cfc4d0c35a6508da522dc6b051b540113f4c041e7cd07bbf",
            "path": "index.js",
            "tlsh": "d311bde8519173640d7549d078a8e0089affeb74b60b4de8d5c906d45386af510b36e2"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-BJ7hPRXSGGd7pmQ9nUAqzXIOHRI7Fk6p7+5ZeOzVwzEjihwoNM6IT1ovyTEb5EktCJGdS1t5TKYPfP215roU3A==",
                "sha1": "4f8218e16850f9bb7751fa1ce16dfd9fe984dc2b"
            },
            "filename": "gd-auth-client-999.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gd-auth-client/MAL-2026-6263.json"