compliancepolicyserv

{"modified":"2026-07-13T17:37:53Z","published":"2026-07-13T17:37:53Z","schema_version":"1.7.4","id":"MAL-2026-10458","summary":"Malicious code in compliancepolicyserv (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8)\ncompliancepolicyserv@9.9.11 registers index.js as both scripts.install and main. On npm install and on require, index.js loads lib/core.js, which reads os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with a 'paypal' prefix, a timestamp, and the domain oob.sl4x0.xyz, and issues a dns.resolve4 query against the resulting subdomain, beaconing installer identifiers over DNS to an author-controlled domain. The destination host and the names of the os/dns/process APIs and their methods (userInfo, hostname, cwd, resolve4) are reconstructed at runtime from char-code arrays in lib/b02e30.js and lib/6ad264.js, hiding the exfil endpoint and sensitive API references from static inspection. The package name resembles a compliance-policy service but the shipped code performs no such function; the sole install/import-time effect is the DNS beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"compliancepolicyserv"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"851793541f79bc8e02df71fc3403191758d44eb4c6fc950c6778525de23a194a","tlsh":"99e068177313c94fa1880bf7b90150a0aa0d8b59a11dc0d6b928678500af443c0c0232"},{"path":"package.json","sha256":"6206199bf5c6083f50598623d60159de9be8201a8e2b1b2f0d524264cb803e31","tlsh":"80215b25ce258c232ad82990a96a6e42f4620c174d447c05b3c7a22c8fdf26f11ff66d"}],"package_integrity":[{"filename":"compliancepolicyserv-9.9.11.tgz","hashes":{"sha1":"6eba25c197269370ab1e61e41d8cc33434d68888","sha512_sri":"sha512-EiegHAR1p2f8TJKwHwCxtMDi7+deqV9opYwOrr1L6ZuZhijMyVHMSJisgnaK8oKG5tV2ObWmcYsERmQngo5IWw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/compliancepolicyserv/v/9.9.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010272","import_time":"2026-07-13T18:10:12.559098679Z","modified_time":"2026-07-13T17:37:53Z","sha256":"a9f18c11413e208ef48e083af8a065b36134c2b37b5fd1474a5701a986a659d8","source":"amazon-inspector","versions":["9.9.11"]}]}}