string-format-kit

{"schema_version":"1.7.4","id":"MAL-2026-11108","published":"2026-07-28T06:27:41Z","modified":"2026-08-05T09:30:33.456650905Z","summary":"Malicious code in string-format-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa)\nThe package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipeline reads ~/.ssh/id_rsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, ~/.aws/credentials, ~/.bash_history, the full process environment, and host reconnaissance output (whoami, hostname, id, sudo -ln, uname, /etc/os-release, /proc/1/cgroup, /.dockerenv, ps aux, ip addr, ls -la /), base64-encodes the aggregate, and transmits it via curl over plain HTTP to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/d. The declared package purpose (string formatting) has no legitimate need to read the installer's SSH private keys or cloud credentials. The name resembles legitimate string-formatting libraries, consistent with typosquatting to lure installations.\n\n## Source: ossf-package-analysis (752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb)\nThe OpenSSF Package Analysis project identified 'string-format-kit' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"string-format-kit","ecosystem":"npm"},"versions":["1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"cd9315d4631bfde5bfe82042b45105c9f42839f41b7b39261e4358957a5f9f3a","tlsh":"195112fcb93578333f1e8a94f3ad6a0a8593dc9f4bf4eb0054b61d280c0cd413665a66"}],"package_integrity":[{"filename":"string-format-kit-1.0.2.tgz","hashes":{"sha1":"82b3fdf6d3ee3b04c3d43c18118eebba1ff52023","sha512_sri":"sha512-7cimO9IBlhN1yhYRC7ZJvoQ5sgecMODdrtnrIuSe3jsqZ3cFUkyTkQxZAWIcMwmdWsXzY21nhA6/Uv6aBmcb7Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/string-format-kit/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/string-format-kit/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-28T07:26:58.183931288Z","modified_time":"2026-07-28T06:27:41Z","sha256":"752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb","source":"ossf-package-analysis","versions":["1.0.2"]},{"id":"IN-MAL-2026-011046","import_time":"2026-08-04T21:33:14.973223296Z","modified_time":"2026-08-04T21:24:42Z","sha256":"d4ab7165e6602c9334efccd6113ccdd4edc62279e23d6a3cc8eb2f909e57a2ae","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-014435","import_time":"2026-08-05T09:28:10.735986751Z","modified_time":"2026-08-05T08:50:01Z","sha256":"9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}