MAL-2026-6987

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@luminarycloudinternal/lcvis-st/MAL-2026-6987.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6987
Published
2026-07-08T16:27:42Z
Modified
2026-07-08T17:16:50.343406805Z
Summary
Malicious code in @luminarycloudinternal/lcvis-st (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24)

Package @luminarycloudinternal/lcvis-st@9999.0.2 is published to the public npm registry under an internal-looking scope with an artificially high version number designed to outrank any legitimate internal release, so misconfigured installers resolve this public copy. On install, the postinstall.js script collects host and user identifiers (os.hostname(), os.userInfo().username, OS type/release/platform/arch), npm package name/version and user-agent, and CI/GitHub identifiers (CI, GITHUBACTIONS, GITHUBREPOSITORY, RUNNERNAME, GITHUBSHA, GITHUBREF, GITHUBWORKFLOW), then sends them as query parameters via HTTPS GET to a hardcoded third-party endpoint at poc-luminary-npm-1782987043.testingboxes.com (postinstall.js line 34). The package self-labels as a Bugcrowd bounty canary, but the behavior — dependency-confusion scope/version combined with install-time transmission of installer identifiers to a hardcoded third-party host — is exfiltration for any installer other than the intended bounty target.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c04d314ba7d8f03fa4063365cf54e924a15af3dd81f66f17fc7ee9742508dc59",
            "id": "IN-MAL-2026-008120",
            "source": "amazon-inspector",
            "import_time": "2026-07-08T17:01:32.182414714Z",
            "modified_time": "2026-07-08T16:27:42Z",
            "versions": [
                "9999.0.1"
            ]
        },
        {
            "modified_time": "2026-07-08T16:28:08Z",
            "id": "IN-MAL-2026-008123",
            "source": "amazon-inspector",
            "import_time": "2026-07-08T17:01:32.391530165Z",
            "sha256": "ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24",
            "versions": [
                "9999.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @luminarycloudinternal/lcvis-st

Package

Name
@luminarycloudinternal/lcvis-st
View open source insights on deps.dev
Purl
pkg:npm/%40luminarycloudinternal/lcvis-st

Affected ranges

Affected versions

9999.*
9999.0.1
9999.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "a82140bb027e613528732994940ee044b673e1b64cd3a6b0b65ce2345f6c55e123e4fa",
            "sha256": "8e4869ca571995ed56830ca97e16655fd068d412c7cba638ee42ca9d52818eae"
        },
        {
            "path": "package.json",
            "tlsh": "9de0f147244063337cd466b31873b21e3a69cb0d14da241843e701c81005ff786276ba",
            "sha256": "4470acc8b6c70912dcc9d5eafbc3433026ea0aa0ff0c3d764c76b773d9c8e670"
        }
    ],
    "package_integrity": [
        {
            "filename": "lcvis-st-9999.0.1.tgz",
            "hashes": {
                "sha1": "1c8a79ecb04400ca8d7d16555db9e5d4837509bc",
                "sha512_sri": "sha512-en2bWVePrKvKg84r/onRYDdNoKVFoivzmxJAC5x7oHsIP2nCKeYY21dfj2HWXwebWpRWBrye6rSxaR9rcegrwQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@luminarycloudinternal/lcvis-st/MAL-2026-6987.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]