MAL-2026-6464

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@colibri-event-types/megamarket-ru-web/MAL-2026-6464.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6464
Published
2026-06-25T17:00:25Z
Modified
2026-06-25T17:31:24.175538997Z
Summary
Malicious code in @colibri-event-types/megamarket-ru-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c4780aaf3b99e11830e6a5eda56c287f9f8e93d375f1f59320ecc9849ebdf4fe)

scripts/postinstall.js is registered as the npm postinstall lifecycle script and is heavily packed with obfuscator.io string-array rotation plus a self-defending/anti-debug IIFE. On install it calls os.platform() to select a per-OS URL (darwin/win32/linux), HTTPS-fetches an opaque binary, writes it to os.tmpdir(), and spawns it via process.execPath (the installer's Node) with detached:true and stdio:'ignore', then.unref()s the child so it survives npm exit. There is no hash, signature, or publisher verification on the fetched bytes. The package's stated purpose ("internal database utilities") is inconsistent with downloading and executing a remote native/JS payload. The scoped name @colibri-event-types/megamarket-ru-web and the fabricated colibri-event-types.io homepage/author/repo metadata are consistent with dependency-confusion bait targeting an internal namespace at a victim organization. Any developer workstation or CI runner that performs npm install of this package executes attacker-controlled code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-25T17:17:25.622688778Z",
            "source": "amazon-inspector",
            "versions": [
                "5.2.8"
            ],
            "id": "IN-MAL-2026-007522",
            "modified_time": "2026-06-25T17:00:25Z",
            "sha256": "c4780aaf3b99e11830e6a5eda56c287f9f8e93d375f1f59320ecc9849ebdf4fe"
        }
    ]
}
References
Credits

Affected packages

npm / @colibri-event-types/megamarket-ru-web

Package

Name
@colibri-event-types/megamarket-ru-web
View open source insights on deps.dev
Purl
pkg:npm/%40colibri-event-types%2Fmegamarket-ru-web

Affected ranges

Affected versions

5.*
5.2.8

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@colibri-event-types/megamarket-ru-web/MAL-2026-6464.json"
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "tlsh": "4a5251087f84a442670e9fab763770e4e55209667b48488ff200bfb9fe95526e6d1f30",
            "sha256": "4a08b65932657e0b2a25f8d8e138a1fe4422d84ebe2250f46e24f207563b31f0"
        },
        {
            "path": "package.json",
            "tlsh": "37218eb1a5218db336e4269eda7406426a712c4f4964bc1937c2852c4bce1fe91be73d",
            "sha256": "566842b009e570249c7fc5bb7e339c258326dd530f620240b3530072fc022156"
        }
    ],
    "package_integrity": [
        {
            "filename": "megamarket-ru-web-5.2.8.tgz",
            "hashes": {
                "sha1": "b777327656343609ede00f0ea646ff02598d6fee",
                "sha512_sri": "sha512-z7bgCgd6bUptplMYM4lP+GH4OmcyFw8PUbd/DBBkXEZHTb9dvItVaHru3JHdaj3fqUgI2cUpHEzadl8QgyX2Pg=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]