bimi-maker

{"modified":"2026-07-14T12:58:33Z","published":"2026-07-14T12:58:33Z","schema_version":"1.7.4","id":"MAL-2026-10579","summary":"Malicious code in bimi-maker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f)\nOn `npm install`, the package's preinstall hook runs `node index.js`, which executes `whoami` and `id` via child_process and collects `os.hostname()`, `os.userInfo()`, `os.platform()`, homedir, cwd, and related host identifiers. The collected JSON payload is POSTed over HTTPS to a hardcoded Burp Collaborator subdomain, `https://mqgby2y4jlp0k06gbpg1ulgjqaw1ks8h.oastify.com/detox56`. The package ships no legitimate functionality matching its BIMI-related name; the only observable behavior is an install-time reconnaissance beacon to an attacker-controlled OAST endpoint, consistent with dependency-confusion or typosquat probing.\n","affected":[{"package":{"ecosystem":"npm","name":"bimi-maker"},"versions":["8.2.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"665e1bfcbbff20ac3582e8fd6898cb06420637ca7cdff2c2c80dda7aa63ba788","tlsh":"7d5151c515fa5a241ba7b8494a0f9402a327e0033509ee55bfcc8740af9937c9bf0bf2"}],"package_integrity":[{"filename":"bimi-maker-8.2.4.tgz","hashes":{"sha1":"a3b057ad33970b6169df8604c3afbbd5f07410d0","sha512_sri":"sha512-Q/KHUwlo8BC0RGBXbg737C/Aeiwj21jjgievPDWwq2k6LZqvOs0Oj4xBsv+ZNui2RdaiQcw+ZIQc7pEaip2VGA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bimi-maker/v/8.2.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010504","import_time":"2026-07-14T13:35:50.025251032Z","modified_time":"2026-07-14T12:58:33Z","sha256":"4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f","source":"amazon-inspector","versions":["8.2.4"]}]}}