content-common

{"modified":"2026-08-06T16:16:52Z","published":"2026-08-06T16:16:52Z","schema_version":"1.7.4","id":"MAL-2026-13442","summary":"Malicious code in content-common (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b)\ncontent-common@99.9.9 declares a preinstall lifecycle script in package.json that executes `node -e` to perform an HTTP GET to a unique subdomain of oastify.com (Burp Suite Collaborator): http://fyhmr907kt8qphysiu67m1p00r6iu8ix.oastify.com. This fires automatically on `npm install`, confirming arbitrary code execution on the installer's host and leaking the installer's public IP and DNS resolver metadata via the unique subdomain lookup to the attacker-controlled collaborator endpoint. The package's self-declared 'Mozilla bug bounty PoC' framing does not change the behavior: any consumer who installs this version triggers the out-of-band callback. The version number 99.9.9 is also consistent with a dependency-confusion / typosquat probe against an internal package name.\n","affected":[{"package":{"ecosystem":"npm","name":"content-common"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"5b305d4502a3bcb1f379b145c02809deed28d9130ea8f51707076432c0f66b90","tlsh":"b0e020f40900e72b14c985f544765406e0959e475114ac485bdb241d42e9e67b4bd18c"}],"package_integrity":[{"filename":"content-common-99.9.9.tgz","hashes":{"sha1":"55b25b863804272856b6597abfc805d1a254cfa6","sha512_sri":"sha512-4SZe8bkOpOc7tzfKHHXAv3gNdLm02jwDqLj8l3zxXK/vLu3FfSrncKN9iclIUZ8gY6r74TkPWfRlD3flXsZbsw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/content-common/v/99.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016669","import_time":"2026-08-06T18:09:03.645180731Z","modified_time":"2026-08-06T16:16:52Z","sha256":"5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b","source":"amazon-inspector","versions":["99.9.9"]}]}}