MAL-2026-6351

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delta-time-32bb/MAL-2026-6351.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6351
Published
2026-06-23T22:26:24Z
Modified
2026-06-23T22:46:25.001336426Z
Summary
Malicious code in delta-time-32bb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bcbd5b3b8f7702c8cf59c094e98f078f68563d407235bce1dd0ec6e6522fe03b)

Package declares a postinstall hook ("postinstall": "node run.js" in package.json) that executes run.js automatically on npm install. run.js imports os, fs, http, https, and child_process and collects host identifiers and environment data — os.hostname(), os.userInfo(), os.platform(), process.env.USER, process.cwd() — base64-encodes the payload via Buffer.from(...).toString('base64'), and POSTs over http/https. The package has no documented purpose justifying install-time host reconnaissance and outbound network. The shape (lifecycle-triggered collection of host identity + environment + base64 wrapping + HTTP POST) is a credential/host-recon exfiltration beacon executed without user interaction on default install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T22:31:28.820392051Z",
            "source": "amazon-inspector",
            "sha256": "bcbd5b3b8f7702c8cf59c094e98f078f68563d407235bce1dd0ec6e6522fe03b",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007391",
            "modified_time": "2026-06-23T22:26:24Z"
        }
    ]
}
References
Credits

Affected packages

npm / delta-time-32bb

Package

Name
delta-time-32bb
View open source insights on deps.dev
Purl
pkg:npm/delta-time-32bb

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "cbe06818dc20393339d02ea90c629297b7308f1b20143d2da3b7282842abb3a747b20d",
            "sha256": "2e37bc22c0691ce0d97a93a6d958b08415c326fef3cd2978c399795c838f80c3",
            "path": "package.json"
        },
        {
            "tlsh": "bf82f77219b7461479a3eaade66fa4005033f1177a41eda0f28c73510fcf668d572af8",
            "sha256": "12c08dbb2041442756015306e4864d161f20a14796245f761d5089b4ce3074e5",
            "path": "run.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "delta-time-32bb-1.0.0.tgz",
            "hashes": {
                "sha1": "42f301b54f1e3159634c739af31a03c4b306d788",
                "sha512_sri": "sha512-tJzKJfH8IiSjLkUpz/I32qImfZVe+EAI1osTZQWyrW4q/r6vyKRuXx3UueykMxex5Gv8E7TXnmc1CJCeIzbAZg=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/delta-time-32bb/MAL-2026-6351.json"