emulative

{"modified":"2026-08-04T23:57:24Z","published":"2026-08-04T23:57:24Z","schema_version":"1.7.4","id":"MAL-2026-11996","summary":"Malicious code in emulative (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca)\nOn npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.\n","affected":[{"package":{"ecosystem":"npm","name":"emulative"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"5864e4ab40950600f1e39f253361f70207fd774aa2fe32349ed1f48ada3e1a10","tlsh":"6e411399a2da17330dd210c0660c70802359f9767169a89076cf42969f869f8b7226f3"}],"package_integrity":[{"filename":"emulative-1.0.1.tgz","hashes":{"sha1":"121db90604b2147ae5a5465ddb557c04da466a9a","sha512_sri":"sha512-UQzS0g5PEVInL3K7C8yMuuL6zSxzk6xDHjcYTQlBAdZUhuM1VVM5sl9Yi5N8+D6AYhAVpjOdyqZCaqZUNoP+tA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/emulative/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011360","import_time":"2026-08-05T00:04:38.793800383Z","modified_time":"2026-08-04T23:57:24Z","sha256":"6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca","source":"amazon-inspector","versions":["1.0.1"]}]}}