MAL-2026-6291

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@outmarket/ui/MAL-2026-6291.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6291
Published
2026-06-23T14:12:09Z
Modified
2026-06-23T14:31:20Z
Summary
Malicious code in @outmarket/ui (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e)

package.json declares a postinstall script that runs automatically on npm install and performs require('https').get(...) to a Burp Collaborator subdomain (7rzjsf29azci2qjsm6kxt23ag1mtanyc.oastify.com), passing os.hostname() and os.userInfo().username as query parameters. Any developer or build system installing this package leaks host identity to an external attacker-controlled OAST endpoint. The package's own description (PENTEST-PoC: Dependency confusion - SecurifyAI engagement 2026-06-23) and the version 9.9.9 published under the @outmarket scope indicate the package is designed to win resolution against an internal private package of the same name and harvest beacons from anyone in the targeted organization who installs it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007207",
            "import_time": "2026-06-23T14:23:03.488562279Z",
            "modified_time": "2026-06-23T14:12:09Z",
            "sha256": "7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e",
            "source": "amazon-inspector",
            "versions": [
                "9.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @outmarket/ui

Package

Name
@outmarket/ui
View open source insights on deps.dev
Purl
pkg:npm/%40outmarket%2Fui

Affected ranges

Affected versions

9.*
9.9.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "f79b34aef25edb1847146983030a7f634d11cbcad642562ea4bc89b86c9f60d8",
            "tlsh": "9de068f849fcf77238c408c954b22a0cb4b3d9255008ac04aae3228886941f75eb167a"
        }
    ],
    "package_integrity": [
        {
            "filename": "ui-9.9.9.tgz",
            "hashes": {
                "sha1": "4ee5f7f689d4bcc02eed83edb3a778f02bd336ae",
                "sha512_sri": "sha512-cZrM6s3n5KxN3lF10sD/pQ0AhJ3lxvIotf6KXHUTdBY7Cd4ZUHzBg88jVpBX0mwAOrEZJN/CgX9kyI/mf+vsdQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@outmarket/ui/MAL-2026-6291.json"