@itsreduxtm/unpkg-xss-test

{"modified":"2026-08-06T23:29:17Z","published":"2026-08-06T16:43:39Z","schema_version":"1.7.4","id":"MAL-2026-13431","summary":"Malicious code in @itsreduxtm/unpkg-xss-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82)\npayload.js is declared as the package `main` and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from https://unpkg.com/@itsreduxtm/unpkg-xss-test@1.0.4/binlist.txt and issues concurrent HEAD requests to https://entretienextremejb.ca/bin/<name> for each entry, sourcing the traffic from the installer's machine and IP address. The package name (`unpkg-xss-test`) and GTFOBins-style wordlist shape indicate this is a browser XSS-delivered path-enumeration payload; when loaded in Node (fetch is global in Node 18+), the installer conducts the scan against a third party. This covertly weaponizes the installer's identity for reconnaissance against an unrelated site, exposing the installer to abuse reports, IP blocklisting, and potential legal complaints for unauthorized scanning.\n","affected":[{"package":{"ecosystem":"npm","name":"@itsreduxtm/unpkg-xss-test"},"versions":["1.0.5","1.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"payload.js","sha256":"dfff3ce3112f348184e76fe1dfa839bda1daa32104fdd72f8f9a2797b9fcbacd","tlsh":"7f51450608bf222baaa331d65b5f20157131c1077645ce8cba9ec3058f55aadd877bee"}],"package_integrity":[{"filename":"unpkg-xss-test-1.0.5.tgz","hashes":{"sha1":"a42b32164eac33d8857b681b3c1d196e0c6099ea","sha512_sri":"sha512-IytC32aIYQuSIkBzRkRkhSpyxAdhvpByYo715eHHi+vb/kNIIqdLM1vZ5ENAFvC4CCpOpcN6o2+Z3FeT7kTNIQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@itsreduxtm/unpkg-xss-test/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@itsreduxtm/unpkg-xss-test/v/1.0.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016714","import_time":"2026-08-06T18:09:09.995613818Z","modified_time":"2026-08-06T16:43:39Z","sha256":"39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-016715","import_time":"2026-08-06T18:09:10.156475393Z","modified_time":"2026-08-06T16:43:49Z","sha256":"881fa2a2e636c13d5a32eb54201d9345d1906d2a2b11360f2789c31f189f28ec","source":"amazon-inspector","versions":["1.0.9"]}]}}