gs-uitk-object-utils

{"modified":"2026-08-05T13:35:07Z","published":"2026-08-05T13:35:07Z","schema_version":"1.7.4","id":"MAL-2026-12791","summary":"Malicious code in gs-uitk-object-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (662b350826118282a93e76c970ab25659d7bc3a52c58e1e16466e4c432d0d1e5)\npackage.json declares scripts.install: `node index.js`, which requires `./lib/core`. lib/core.js reads the OS username, hostname, and current working-directory basename, assembles them with a hardcoded `goldman1` prefix into a subdomain of `oob.sl4x0.xyz`, and issues a `dns.resolve4` lookup against that name, causing the installer's host identifiers to be transmitted as a DNS query to the attacker-controlled authoritative server. The destination domain, prefix, and API names (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`) are stored as char-code arrays in lib/b02e30.js and lib/6ad264.js and decoded at runtime via String.fromCharCode, concealing the exfiltration path. The same code also fires on `require()` of the package. The package presents itself as an object-utility library, which does not match the observed install-time DNS beaconing.\n","affected":[{"package":{"ecosystem":"npm","name":"gs-uitk-object-utils"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"11e186abc3ce7b8407d8029071178c6af78d509e8f46293e5fd5d965321e48c3","tlsh":"59e06f033303c90fa0980bfb7e0150a0aa0c8b58a26c80dab628638601bf043e1c0222"}],"package_integrity":[{"filename":"gs-uitk-object-utils-9.9.11.tgz","hashes":{"sha1":"af4e13635942a1cbda072b1c993f14a4b912dd29","sha512_sri":"sha512-BFwiNE8flQ2CdTtk1op5heXJZ4AMGVjHNIsyLE0Msw4j5d1BKc/xOUxuVf5q+M7HhBLSrU4F2lwvhEzaSSPyVg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gs-uitk-object-utils/v/9.9.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014981","import_time":"2026-08-05T14:19:49.087379932Z","modified_time":"2026-08-05T13:35:07Z","sha256":"662b350826118282a93e76c970ab25659d7bc3a52c58e1e16466e4c432d0d1e5","source":"amazon-inspector","versions":["9.9.11"]}]}}