MAL-2026-6371

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/llm-traces-app/MAL-2026-6371.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6371
Published
2026-06-24T03:36:16Z
Modified
2026-06-24T05:01:21.428461960Z
Summary
Malicious code in llm-traces-app (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c0916c8694f396dfa0947df6e3b3d3966839a6e02d4a4f5b84f698787c446bdc)

On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identity (os.hostname(), os.userInfo(), homedir, DNS servers, cwd) and reads the installer's /etc/passwd and /etc/hosts, then HTTPS POSTs the combined payload to ltiyq4zyhrs88zgp5lef9hbec5i46uuj.oastify.com — a Burp Collaborator (OAST) subdomain controlled by the package publisher. The exfiltration fires automatically on default install with no user interaction. Reading /etc/passwd enumerates the installer's local user accounts; the OAST destination provides the publisher with arbitrary out-of-band data capture. This is a textbook dependency-confusion / supply-chain exfiltration beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T04:54:33.60915667Z",
            "source": "amazon-inspector",
            "sha256": "c0916c8694f396dfa0947df6e3b3d3966839a6e02d4a4f5b84f698787c446bdc",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007412",
            "modified_time": "2026-06-24T03:36:16Z"
        }
    ]
}
References
Credits

Affected packages

npm / llm-traces-app

Package

Name
llm-traces-app
View open source insights on deps.dev
Purl
pkg:npm/llm-traces-app

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "5c411399a2c917330dd114c0660c70802359f9777159e89076cf42d69f869f8b7316f3",
            "sha256": "2366c47882d392d747f54b6c960959feff25b001d7ba6722f0b003e04ea85738",
            "path": "index.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/llm-traces-app/MAL-2026-6371.json"