MAL-2026-6318

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-bn-lint-helper/MAL-2026-6318.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6318
Published
2026-06-23T16:11:21Z
Modified
2026-06-23T17:01:25.435948063Z
Summary
Malicious code in ts-bn-lint-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267)

Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported fromstr() recursively walks process.cwd() and uploads every file matching id.json, config.toml, Config.toml, config.json, env, and.env to https://data-stream.space/api/v1 via axios POST (index.js:178). It additionally harvests shell history from ~/.bashhistory, ~/.zshhistory, fish history, ~/.shhistory, and PowerShell PSReadLine ConsoleHosthistory.txt, falling back to spawning bash -c history and zsh -c 'fc -l -1000' via execSync (index.js:101, 117, 128-152). The exfiltration URL and target file patterns are base64-encoded module-level constants decoded through a decodeStr helper (index.js:8-30) to evade naive string scanners. Username and local IP are prepended to each upload. The bundled test.js auto-invokes fromstr() under npm test. Package metadata is hollow (empty description, author, keywords) and the name mimics legitimate TypeScript lint tooling. Any consumer that requires this package and calls from_str(), or runs npm test, ships their working-directory secrets and shell history to the attacker-controlled host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267",
            "id": "IN-MAL-2026-007264",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T16:11:21Z",
            "versions": [
                "3.1.19"
            ],
            "import_time": "2026-06-23T16:54:12.807378937Z"
        }
    ]
}
References
Credits

Affected packages

npm / ts-bn-lint-helper

Package

Name
ts-bn-lint-helper
View open source insights on deps.dev
Purl
pkg:npm/ts-bn-lint-helper

Affected ranges

Affected versions

3.*
3.1.19

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-bn-lint-helper/MAL-2026-6318.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "addbcd00de83cb84cce6655375cce010012e1d9724207692c05a7b5699034e7d",
            "tlsh": "94e166aa01162136d6f1e3f8eb560416f79ed2137602c74276ac4ac92f77428e1d2fec",
            "path": "index.js"
        },
        {
            "sha256": "cdea78bc905183eb899ea3a9363778b427c7cc704c2f1fe88fa983cf538a04b9",
            "tlsh": "2fe0c2328e69a93708f8a6a56e681b03f1618f2f12748c0f71f7551c97e31a304a8f4d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "ts-bn-lint-helper-3.1.19.tgz",
            "hashes": {
                "sha1": "5575cbd59199abe6385ec39e64e82c53ed1e497d",
                "sha512_sri": "sha512-tVD1gUs5BvFLxhrm6JjlchfG2r0xESuFdGF6r4gcn7e3ZhfHafIDWnTED8YROBGyVeGC1QeV/MCurgi+n/zeog=="
            }
        }
    ]
}