relativity-foundation-core

{"schema_version":"1.7.4","id":"MAL-2026-12426","published":"2026-08-05T12:59:36Z","modified":"2026-09-01T11:20:29.495892819Z","summary":"Malicious code in relativity-foundation-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d)\npackage.json declares a preinstall script that runs a Node one-liner collecting os.hostname(), process.env.USER/USERNAME, cwd, npm_config_registry, CI, GITHUB_REPOSITORY, JENKINS_URL, and platform, base64-encodes the JSON blob, and issues an HTTPS GET to https://aiwi9di43fzbjwncfrimdvkgu701orcg.oastify.com/?d=<base64> on every `npm install`. index.js is empty, so the package's only effect is this reconnaissance beacon. The oastify.com destination is a Burp Collaborator subdomain used as an attacker-controlled out-of-band exfiltration sink.\n","affected":[{"package":{"name":"relativity-foundation-core","ecosystem":"npm"},"versions":["6.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"988248624029a2a1d021e1a0ad294d799ba1e74a258f93b4bd313f95de534641","tlsh":"f6f0fe2d876cc83b05d10ba025795c879cb2bdaa330898619f53b00e6fe83a2017302f"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/relativity-foundation-core/v/6.8.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014838","import_time":"2026-08-05T13:08:50.275070367Z","modified_time":"2026-08-05T12:59:36Z","sha256":"0c61f9e4ea2d66ea8dd4b9018fa109fe65d00cb0de98b3f8551a95ca3859af5d","source":"amazon-inspector","versions":["6.8.2"]},{"id":"RLMA-2026-06436","import_time":"2026-09-01T11:17:33.968780169Z","modified_time":"2026-08-24T17:08:11Z","sha256":"c3b0aedbf834b382e47e304ab719cba5a41c83cd9e73a12055664d58564f5936","source":"reversing-labs","versions":["6.8.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}