exodus-payments

{"schema_version":"1.7.4","id":"MAL-2026-10895","published":"2026-07-20T10:42:42Z","modified":"2026-09-01T11:20:26.253133893Z","aliases":["GHSA-hrvv-3w2f-pp24"],"summary":"Malicious code in exodus-payments (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e)\nPackage is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook (src/canary.js) performs a DNS lookup and HTTPS GET to a hardcoded Serveo tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com), sending only the package's own name and version as query parameters. No environment variables, credentials, filesystem contents, or other installer data are read or transmitted; the only signal the operator gains is the installer's public egress IP from the inbound request metadata. README discloses the canary purpose. Concerns: install-time outbound network without opt-out (breaks air-gapped/sandboxed CI), destination is a third-party mutable tunneling endpoint rather than publisher-owned infrastructure, and the canary version coordinate (99.0.0-canary.1) is shaped to win dependency-confusion races against private packages. No credential theft, no code execution of remote content, no persistence.\n","affected":[{"package":{"name":"exodus-payments","ecosystem":"npm","purl":"pkg:npm/exodus-payments"},"versions":["99.0.0-canary.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/canary.js","sha256":"16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51","tlsh":"37e06ffe4fd0a33a56701bc9f080a54fe707e3283085a2c1d69822a249c28f0ae218f0"}],"package_integrity":[{"filename":"exodus-payments-99.0.0-canary.1.tgz","hashes":{"sha1":"ef1889f61bed28df187b2967497ecdf8afe04463","sha512_sri":"sha512-SlHTjiBKt3pWq5iSy2JO/SjNK83FfqARXq9gFRveex+ltnNAreNWjmKIqGLwiyfMUTQr3vXbuO1vlliI3MFR0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/exodus-payments/v/99.0.0-canary.1"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hrvv-3w2f-pp24"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-05535","import_time":"2026-07-20T13:14:46.17221799Z","modified_time":"2026-07-20T10:42:42Z","sha256":"328b16bdcd1792de22d87fbbe353e2fc58968a0c1f64f46eddd29da089df2495","source":"reversing-labs","versions":["99.0.0-canary.1"]},{"id":"IN-MAL-2026-012910","import_time":"2026-08-05T06:00:18.869471273Z","modified_time":"2026-08-05T05:06:43Z","sha256":"51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e","source":"amazon-inspector","versions":["99.0.0-canary.1"]},{"id":"RLUA-2026-06229","import_time":"2026-09-01T11:18:05.674058156Z","modified_time":"2026-08-24T16:50:58Z","sha256":"16663a5c8890c81d50b74bc27316c674904d9a157afe9ba82e1c579024624d06","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}