infrastructure-common

{"modified":"2026-07-16T18:38:23Z","published":"2026-07-16T18:38:23Z","schema_version":"1.7.4","id":"MAL-2026-10734","summary":"Malicious code in infrastructure-common (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578)\npackage.json declares a preinstall lifecycle script that runs `node -e` to issue an HTTP GET to a Burp Collaborator subdomain at w635fyvrqkfmh9wc9uw8444cp3vujl7a.oastify.com when `npm install` runs. The callback confirms code execution on the installer's host and leaks the installer's public IP and DNS resolver to a third-party listener. The package name `infrastructure-common` combined with an implausibly high `99.9.9` version is the canonical dependency-confusion shape, in which a public package is registered to shadow an internal name at install-time resolution.\n","affected":[{"package":{"ecosystem":"npm","name":"infrastructure-common"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"d91bd983e0c82bcc812a6f1f5cf8141d519203d125e0e74a253d8008d8e236f1","tlsh":"0ae0c0f40460e1bb54e88ad51c720805f0d55e470004ac041be7101e02de36794be1dc"}],"package_integrity":[{"filename":"infrastructure-common-99.9.9.tgz","hashes":{"sha1":"96d6035a5bb9599320e85f973b4158a98b82f1b3","sha512_sri":"sha512-IW06zaQde7c+NSf/YdDaJQ1oibW+/JpU8wjUqESSco4N+b0kZAIVWBWc2cOE7MKWeYCZPofPCm1cY1WW6fjj8A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/infrastructure-common/v/99.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010726","import_time":"2026-07-16T18:54:01.431048599Z","modified_time":"2026-07-16T18:38:23Z","sha256":"d64169ae87d8d9eaad199be028a70610f025f61e0c947838c05c24a1dd4d5578","source":"amazon-inspector","versions":["99.9.9"]}]}}