fkext-browser-min

{"schema_version":"1.7.4","id":"MAL-2026-10183","published":"2026-07-10T22:43:30Z","modified":"2026-09-01T11:20:26.448637623Z","aliases":["GHSA-rc5q-c5vp-6g46"],"summary":"Malicious code in fkext-browser-min (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c)\nThe package runs vishu.js as a preinstall lifecycle hook on `npm install`. That script fetches the machine's public IP from api.ipify.org, collects os.hostname() and GitHub Actions / CI environment variables (GITHUB_*), and transmits them as query parameters to a hardcoded webhook.site collector URL over HTTPS. It additionally performs a DNS lookup of a subdomain of the form `ping-<hostname>.<collaborator>.oastify.com`, providing an out-of-band exfiltration channel (Burp Collaborator style) that bypasses HTTP egress filters. There is no legitimate functionality shipped alongside this — the package's only install-time effect is host reconnaissance and beacon-out to attacker-controlled sinks. This is a dependency-confusion / bug-bounty-style beacon against installer/CI environments.\n","affected":[{"package":{"name":"fkext-browser-min","ecosystem":"npm"},"versions":["1.0.14"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vishu.js","sha256":"148b5be8544f83525c7442f450050b49d7bb467ee17d3b5df9d23c4f39663f8c","tlsh":"7831104db2f7551004f263c8561b951e715be1533325dda1799c02521faad3c82e3bd8"}],"package_integrity":[{"filename":"fkext-browser-min-1.0.14.tgz","hashes":{"sha1":"956d600ab58369d4f8abe1eb7b363df2092d4b65","sha512_sri":"sha512-F5c2Lb6QIXFu+3ldBEdQ3gOZ9b+aOHDYbx8cXRSCgQAmPyrNjZRoHMHL7ZOJY+CeS20rE+Z4rFKAbE+U4hNAWg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fkext-browser-min/v/1.0.14"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rc5q-c5vp-6g46"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009728","import_time":"2026-07-10T22:50:19.244634627Z","modified_time":"2026-07-10T22:43:30Z","sha256":"1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c","source":"amazon-inspector","versions":["1.0.14"]},{"id":"RLMA-2026-05540","import_time":"2026-07-20T13:14:46.361202314Z","modified_time":"2026-07-20T10:43:39Z","sha256":"34c36db539a94663e23abbab6291033237a0f58136fb2f46e59f77cb39a00cd0","source":"reversing-labs","versions":["1.0.14"]},{"id":"RLUA-2026-06243","import_time":"2026-09-01T11:18:06.641733928Z","modified_time":"2026-08-24T16:51:57Z","sha256":"0fb0dd978b102e77629950113b3d700eaf2e49cba045f94bf6686cbdbddcb12a","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}