MAL-2026-6379

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simplisafe-gatsby/MAL-2026-6379.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6379
Published
2026-06-24T07:35:59Z
Modified
2026-06-24T08:01:24.004242347Z
Summary
Malicious code in simplisafe-gatsby (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (564baff2e47527f159c52c527e1ea2b93d73625f94737f4397cff99311871a18)

On npm install, the package's preinstall hook (package.json declares "preinstall": "node index.js") executes index.js, which collects the installer's hostname, username, home directory, DNS configuration, package metadata, and the contents of /etc/passwd and /etc/hosts (via fs.readFileSync), then POSTs the collected data over HTTPS to a Burp Collaborator subdomain at xpqamgvad3ok4bc11xar5t7q8he820qp.oastify.com. The package has no advertised functionality (empty author, empty description, single recon payload file) and its name is consistent with a dependency-confusion attempt against SimpliSafe's internal Gatsby package namespace. Any machine that runs npm install against this name will leak system identity and local-account information to the attacker.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T07:47:32.596717144Z",
            "modified_time": "2026-06-24T07:35:59Z",
            "sha256": "564baff2e47527f159c52c527e1ea2b93d73625f94737f4397cff99311871a18",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007432",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / simplisafe-gatsby

Package

Name
simplisafe-gatsby
View open source insights on deps.dev
Purl
pkg:npm/simplisafe-gatsby

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "7d411195a2c917330dd214c06a0c74812359fa767269a99076cf4296af869f8b7326f3",
            "sha256": "f09b67d06c7374cf6d577cd70974a89031114bacd3390dde98b34eeb025abc4d",
            "path": "index.js"
        },
        {
            "tlsh": "afd05e244d21653325c50662082a949662a2ce2f14043c08638f582c81de67798fb31c",
            "sha256": "0a98f68bc971c850e49b33615d30d9a1552f317b3a02a94f286a32a8a3e027ef",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/simplisafe-gatsby/MAL-2026-6379.json"