tracker-radar-detector

{"schema_version":"1.7.4","id":"MAL-2026-12483","published":"2026-08-05T12:38:24Z","modified":"2026-09-01T11:20:30.671821827Z","summary":"Malicious code in tracker-radar-detector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1)\npackage.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, DNS server list, and current working directory, and reads /etc/passwd and /etc/hosts when present, then HTTPS POSTs the combined payload to a Burp Collaborator subdomain at mka6p95xmnkfcmdxv8cb4h2rpivej47t.oastify.com. Execution is automatic on install with no consumer interaction, and the destination is an out-of-band callback host unrelated to any legitimate tracker/detector functionality.\n","affected":[{"package":{"name":"tracker-radar-detector","ecosystem":"npm"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"8a8876eb4283e287410f72cc430fea8f66296f672826a2562c70678741ec8128","tlsh":"ce412399a2c917330dd210c06a0c70813359fa777169a89076cf42d69f869f8b7326f3"}],"package_integrity":[{"filename":"tracker-radar-detector-1.0.1.tgz","hashes":{"sha1":"3df82f1c6ad031f8549f0401a133ff4c30cb03b3","sha512_sri":"sha512-bECmTh1O/XZczho2Tvm2iGrOkcl2xCs8Ic5m3h8dWJhcRPJSp1RC5l38X5npkaa+SGiLuVYVHVXhtV/OYk/Jbg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tracker-radar-detector/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014739","import_time":"2026-08-05T13:08:42.40583441Z","modified_time":"2026-08-05T12:38:24Z","sha256":"570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1","source":"amazon-inspector","versions":["1.0.1"]},{"id":"RLMA-2026-06525","import_time":"2026-09-01T11:17:34.978606676Z","modified_time":"2026-08-24T17:14:26Z","sha256":"9a8864867a3801c42a0b94488f29b74871d185b849d78446e45c87c4862a93d1","source":"reversing-labs","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}