MAL-2026-6352

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hex-conv-ae7a/MAL-2026-6352.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6352
Published
2026-06-23T21:40:34Z
Modified
2026-06-23T22:46:23.655232953Z
Summary
Malicious code in hex-conv-ae7a (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (35d4f6adb1ef40a529deec65b7409b949cd93ad60d6cf3880ff5e8f0079fef1f)

The package's package.json declares a postinstall hook ("postinstall": "node run.js") that runs run.js automatically on npm install. run.js imports os, fs, http, https, and child_process and collects host identity and environment data including os.hostname(), os.userInfo(), os.platform(), process.env.USER, and process.cwd(), reads files from the filesystem (fs.readFileSync, fs.existsSync), base64-encodes payloads via Buffer.from(...).toString('base64'), and POSTs the result over http/https to a remote endpoint. This is the canonical install-time host-reconnaissance and exfiltration shape: a default npm install of this package automatically sends installer machine information off-host without any user interaction or documented purpose. The package name (hex-conv with a random hex suffix) is consistent with throwaway/disposable squatting infrastructure and the package has no legitimate library functionality matching this behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-23T22:31:27.114287395Z",
            "source": "amazon-inspector",
            "sha256": "35d4f6adb1ef40a529deec65b7409b949cd93ad60d6cf3880ff5e8f0079fef1f",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007372",
            "modified_time": "2026-06-23T21:40:34Z"
        }
    ]
}
References
Credits

Affected packages

npm / hex-conv-ae7a

Package

Name
hex-conv-ae7a
View open source insights on deps.dev
Purl
pkg:npm/hex-conv-ae7a

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "3fe061188c30393335d01ea90c519157a7304f0b20147d1c52772429429bb3a747b10d",
            "sha256": "12a70ba94c70cccf336e165141296a608405fd9ee0b11bedcf57b602cdf7c812",
            "path": "package.json"
        },
        {
            "tlsh": "ad82d67229f6461479a3eaade75fa4006523f1077a51eda0f28c73610fcf568c162af8",
            "sha256": "64657d20ee0af3addfbf8fc262d0a680bd2f4eb79a3645d57bf04953a58fa301",
            "path": "run.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "hex-conv-ae7a-1.0.0.tgz",
            "hashes": {
                "sha1": "6f5a5392fffca7d0831aacd047950593512cbd86",
                "sha512_sri": "sha512-edcyovEm03Y+2qO75jVXZ1oFYsgFfwSFleO0Bu3eZ53VfJeFqwwke7u4zO8LbvIpRD86tOwrkeNRJNW+oeVWug=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hex-conv-ae7a/MAL-2026-6352.json"