MAL-2026-6570

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pkg-fallback/MAL-2026-6570.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6570
Published
2026-06-29T04:26:41Z
Modified
2026-06-29T05:16:42.636070702Z
Summary
Malicious code in pkg-fallback (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c)

Package advertises itself as a small string-manipulation library (trim, case, pad, wrap) but its install-time behavior is a dropper. package.json declares a direct dependency native-bridge as http://157.254.194.200:8080/native-bridge-1.0.0.tar.gz — a plain-HTTP tarball on a bare IP unrelated to any publisher. On npm install, npm fetches that arbitrary tarball and installs it into the consumer's node_modules tree, running its own lifecycle scripts. Additionally, the declared postinstall script (scripts/check-binary.js) downloads a second tarball, npm-dependency-payload-1.0.0.tar.gz, over plain HTTP from the same bare IP and writes it to .cache/native.tgz with errors silently swallowed. Neither fetch is pinned, hash-verified, or sourced from publisher infrastructure, and the shipped tarball contains no native source code that would justify a native-bridge dependency. The string-utility cover story is inconsistent with the install-time behavior, which is the deliberate-evasion shape of a supply-chain dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-06-29T04:26:41Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c",
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007723",
            "import_time": "2026-06-29T05:07:07.242244764Z"
        }
    ]
}
References
Credits

Affected packages

npm / pkg-fallback

Package

Name
pkg-fallback
View open source insights on deps.dev
Purl
pkg:npm/pkg-fallback

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pkg-fallback/MAL-2026-6570.json"
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "cef05a78e24cffd4a77e7e7ef390a31a8b0ce58d3754950b56cf225219b11273",
            "tlsh": "35f0d4004e22463306dcaba71c3a11c35a744907094d7c3d72c7000c475c18a17ff32c"
        },
        {
            "path": "scripts/check-binary.js",
            "sha256": "fb18884ad31b2142656181b040f7dcf87c410ddb9e9898c466a5d8576a53749b",
            "tlsh": "3a1123de15f02518d4b1b759c1bfc56aa5f7e0216347a644e098c59a0f704610712c7c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "825c8bc5dbdc54ff3f3092a202c68bff671d78c2",
                "sha512_sri": "sha512-BrsqWdRFG7Z68KRkDt0N+1S/YJ9DO/sohLdwfeTR1EmnJ7A+sbCGjrZsKQvoZwYlST2xOF7VV0Y6iddooZ7JFg=="
            },
            "filename": "pkg-fallback-1.1.0.tgz"
        }
    ]
}