messenger-style

{"schema_version":"1.7.4","id":"MAL-2026-12796","published":"2026-08-05T13:18:24Z","modified":"2026-09-24T09:23:27.663948019Z","summary":"Malicious code in messenger-style (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10)\nThe package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.\n","affected":[{"package":{"name":"messenger-style","ecosystem":"npm"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d5430414b2826cc5db00f9f5ae556e542997c6c46d3bd7f2b440c0d2f5de4514","tlsh":"ae41259992d917330de210c0660c70843359fa777259999076cf42d6af869f8b7326f3"}],"package_integrity":[{"filename":"messenger-style-1.0.1.tgz","hashes":{"sha1":"406b89c9b49b7134dbfa6efd620a7a5e87edb627","sha512_sri":"sha512-ukrk9WgR4OYXOyIxZOuZyrUdZP9VcjJpZFL6cY60ZqjNeUlTwMljjV2FsmNoKcWPtmjXgqOXbBZ2lLyr0qygCQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/messenger-style/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014966","import_time":"2026-08-05T14:19:47.551653501Z","modified_time":"2026-08-05T13:18:24Z","sha256":"48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10","source":"amazon-inspector","versions":["1.0.1"]},{"id":"RLMA-2026-10760","import_time":"2026-09-24T09:21:34.832636327Z","modified_time":"2026-09-22T17:32:18Z","sha256":"5d3ef8925eb477ec2e943816f1ac33ced93d62e2bcf7119ec51f3403357ba85a","source":"reversing-labs","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}