@kite-js-tools/core

{"modified":"2026-08-05T13:04:58Z","published":"2026-08-05T13:04:58Z","schema_version":"1.7.4","id":"MAL-2026-12319","summary":"Malicious code in @kite-js-tools/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9)\npackage.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall hook performs an HTTPS GET to https://d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro/ with the installer's hostname and process PID embedded in the URL path. The postinstall hook performs a DNS resolution against postinstall.<hostname>.d9hugcagp7gsdcl9dvs0frxfmqc1o8u86.oast.pro, leaking the same host identifier via DNS to the same collaborator subdomain. The destination is a Project Discovery Interactsh (OAST) subdomain — out-of-band callback infrastructure typically used to confirm code execution and exfiltrate identifying data from compromised machines. Installer-side host identifiers leave the machine to an attacker-controlled endpoint on every install.\n","affected":[{"package":{"ecosystem":"npm","name":"@kite-js-tools/core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"90cbe6cbf418bdaeef7e43fe7328490f1f2046833b13de8495a82c1163ffba08","tlsh":"81f0c93ece70db3136c08ae0060f0605f473891a81160904ebe3274d12ce3aa49bf495"}],"package_integrity":[{"filename":"core-1.0.0.tgz","hashes":{"sha1":"52287aeeb0c61f70751a71715f96eee42ba1aa41","sha512_sri":"sha512-vkyCA4ipdaiB0XzrKqpNDN4gDfvEcGKqpbfGlp4LMdJ7IdDFcIQWxZMvld1m2HJBuawQAc4kUATYFoK3PKiVOA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kite-js-tools/core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014874","import_time":"2026-08-05T13:08:52.348427671Z","modified_time":"2026-08-05T13:04:58Z","sha256":"5fc1e1caf8550f3daa91e586dd7b4eab7f5ec8f62acc12dce63d9d60c293e7c9","source":"amazon-inspector","versions":["1.0.0"]}]}}