MAL-2026-6479

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@salem_jalal/osc-components/MAL-2026-6479.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6479
Published
2026-06-25T22:23:33Z
Modified
2026-06-25T23:16:24.451922982Z
Summary
Malicious code in @salem_jalal/osc-components (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb26651411f61b6420c6291f7b3a7a4869bb670f1d4c75ddfc37481c50f3aae7)

The package's postinstall hook (install.js, wired via package.json scripts.postinstall) runs on every npm install and transmits installer host identifiers — hostname, OS platform/arch, username, current working directory, Node version, npm registry env, and DNS server list — to http://dm-tech.ly:8001/poc-osc/callback over plain HTTP as a URL-encoded query parameter. The main module (index.js) contains an IIFE that, when loaded in a browser context (e.g., bundled into a downstream web app), harvests document.cookie, all localStorage entries, the current URL, and userAgent, and ships them to http://dm-tech.ly:8001/poc-osc/exfil with credentials:'include'. Although published under the personal scope @salem_jalal, the payload self-identifies internally as @dx-ui/osc-components at the same version 1981.17.7, indicating a dependency-confusion / namespace-impersonation attack against the @dx-ui scope. Console and path strings labeled [PoC] / poc-osc are cover framing; the code runs unconditionally on real installers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-25T23:00:33.858602798Z",
            "source": "amazon-inspector",
            "sha256": "cb26651411f61b6420c6291f7b3a7a4869bb670f1d4c75ddfc37481c50f3aae7",
            "versions": [
                "1981.17.7"
            ],
            "id": "IN-MAL-2026-007550",
            "modified_time": "2026-06-25T22:23:33Z"
        }
    ]
}
References
Credits

Affected packages

npm / @salem_jalal/osc-components

Package

Name
@salem_jalal/osc-components
View open source insights on deps.dev
Purl
pkg:npm/%40salem_jalal%2Fosc-components

Affected ranges

Affected versions

1981.*
1981.17.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "c901bde956dcc9653af75680b6b6500756baf200360674e0faea43d2138d86486b23f0",
            "sha256": "1cde3aebf2c32f7d5e402719cd8a22fdda666fb04fbc65fff5ae481a27e02d94",
            "path": "install.js"
        },
        {
            "tlsh": "440123a935a42555105720a926b3300ab03af463bd5d62f4b1ca0a413f4d32f83a61cd",
            "sha256": "4846405a37bee9f21ae4fd6247f70a23c8b332d42a6264fe11e37131ab0905bc",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "osc-components-1981.17.7.tgz",
            "hashes": {
                "sha1": "fb3d3d0152e68717e139f3b22ebe4f20666bd33b",
                "sha512_sri": "sha512-cPZ26monDGv9PZQBGer2AQPhFcXcprcwknI3VCscwuPNWf5sidZ6c8PCDBCvi+8vT9jGSeFeZzZ3O6XMBt6Png=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@salem_jalal/osc-components/MAL-2026-6479.json"