frontend-vue-next

{"schema_version":"1.7.4","id":"MAL-2025-49410","published":"2025-11-09T00:17:09Z","modified":"2026-09-01T11:20:26.514485290Z","aliases":["GHSA-7492-2cqc-6827"],"summary":"Malicious code in frontend-vue-next (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474)\npackage.json declares \"preinstall\": \"node index.js\", causing index.js to execute automatically on npm install. The script collects system identity (os.hostname(), os.userInfo() including username/uid/gid/shell, platform, arch, home directory, cwd, cpu/memory info) and executes shell commands `whoami` and `id` via child_process, then POSTs the aggregated JSON to a hardcoded URL https://7z7l0xz2ay3chokh48nrncmaz15stih7.oastify.com/testbydext. The destination is a Burp Suite Collaborator out-of-band subdomain — a throwaway, attacker-controlled listener used to capture exfiltrated data. The package metadata is empty (no author, no description, no repository), and the name rides on the Vue/Next.js namespace as a lure. Installing this package on a developer machine or CI runner leaks host and user identity to the attacker without consent.\n","affected":[{"package":{"name":"frontend-vue-next","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"c1ede895eb539736a9b4104d9b19065ba4afc53cecd3932e4cdf715898f7fab5","tlsh":"43513fc515f656251ba7a8494a4f9402b327e0033509ee55bfcc8740af9837c97f0bf6"},{"path":"package.json","sha256":"714b280bddbcd6e4402a33df222a91796b9117c8c9d3af2d0487528a42edfbac","tlsh":"65d05e304d21653365c102a64c6ba44762719e2f14043c08678b182c91ce7b798fe34d"}],"package_integrity":[{"filename":"frontend-vue-next-1.2.0.tgz","hashes":{"sha1":"ce998ee03f1de8a488fe674d0b127882ec0195d9","sha512_sri":"sha512-ATC7pDq8clHEQa2H2VBhqFufCzT3dZWipp6qfoMMR36YJeNCp6CKtktJwancRAQuOyTnn+Itjfkoy7PSwjttDw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/frontend-vue-next/v/1.2.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7492-2cqc-6827"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2025-11-09T00:27:23.743441901Z","modified_time":"2025-11-09T00:17:09Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"cc961cf637890bd581b7ba0471152cb4a26299f03fbfb467570044f52e7d094d","source":"amazon-inspector"},{"id":"RLMA-2025-06356","import_time":"2025-12-23T22:38:30.843243478Z","modified_time":"2025-12-23T08:14:33Z","sha256":"49cb9d3c09154d511f0abd850e746684a208e0d23a8aa2697ebb7c3fef9ebd15","source":"reversing-labs","versions":["1.0.0"]},{"id":"IN-MAL-2026-002757","import_time":"2026-05-15T07:37:19.141621908Z","modified_time":"2026-05-14T19:25:48Z","sha256":"5ecba1e4c2f32734e178b8a3697ed962053354867af75787af708f92f0da2474","source":"amazon-inspector","versions":["1.2.0"]},{"id":"RLUA-2026-05098","import_time":"2026-07-09T09:17:07.104335529Z","modified_time":"2026-07-07T12:52:08Z","sha256":"2c39f358d76e6324ebfd87bdb7cedf7560c2f8f3253e4af7f7eaf1934926d2c1","source":"reversing-labs","versions":["1.2.0"]},{"id":"RLUA-2026-06249","import_time":"2026-09-01T11:18:07.261576551Z","modified_time":"2026-08-24T16:52:29Z","sha256":"b3e6e49d8f65a9f03423578110e4432de1a761f746aceac3593f604861e6b75f","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}