x509-escaping

{"schema_version":"1.7.4","id":"MAL-2025-889","published":"2025-02-03T17:06:31Z","modified":"2026-09-18T20:39:38.928385783Z","summary":"Malicious code in x509-escaping (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731)\npackage.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.\n","affected":[{"package":{"name":"x509-escaping","ecosystem":"npm","purl":"pkg:npm/x509-escaping"},"versions":["0.0.0","0.0.1","0.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"81f55a1213ee2e67da43780b25c0734a6a5f90e9b67fc440ab68464b79a08619","tlsh":"d9412395a2d917330dd210c06a0c70843359fa777159e99076cf42979f869f8bb326f3"}],"package_integrity":[{"filename":"x509-escaping-1.0.1.tgz","hashes":{"sha1":"e5980ec78ef7404cf6f01aa7aaf22c7db050f5e4","sha512_sri":"sha512-PkiKcoazyFitKmcsA3kgWo3ysZU5L2X8G6zC9qZdTu0r1nkdO3axp1Wg9bS8tPoeSf9k2QWbznJHXOwClyMw9A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/x509-escaping/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2025-00423","import_time":"2025-02-03T18:38:04.174023283Z","modified_time":"2025-02-03T17:06:31Z","sha256":"6150f863fcd7f7c787080f68ad3ce92693dbde72ba3dc5988151cec8c5f99578","source":"reversing-labs","versions":["0.0.0","0.0.1","0.0.2"]},{"id":"IN-MAL-2026-020189","import_time":"2026-09-18T20:38:13.921745248Z","modified_time":"2026-09-18T20:25:23Z","sha256":"a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}