poc-ch4rlygr

{"modified":"2026-08-06T23:29:20Z","published":"2026-08-06T19:09:42Z","schema_version":"1.7.4","id":"MAL-2026-13454","summary":"Malicious code in poc-ch4rlygr (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04)\nOn require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents of process.env (serialized via Object.entries(process.env)) and issues an HTTPS GET carrying that data as a querystring to the hardcoded host zuxsp9k9vyk5y45z1n2hv0orhin9b2zr.oastify.com (a Burp Collaborator / OAST subdomain identified in-source as the receiver). Any secrets present in the installer's environment at load time (AWS_*, NPM_TOKEN, GITHUB_TOKEN, CI provider tokens, etc.) are leaked verbatim to that endpoint. package.json also declares a postinstall of `node tu-script.js`, but tu-script.js is not shipped in the tarball; the import-time module code is the operative exfiltration path.\n","affected":[{"package":{"ecosystem":"npm","name":"poc-ch4rlygr"},"versions":["1.5.0","1.3.0","1.4.0","1.2.0","1.1.0","1.6.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"f7d642d44b5c3308b59365fe78b7d42fecce36ff6a81057f49d1f2d832cf6f72","tlsh":"b13165a660e42ea06cf7f1c0f7997417655b8b40b819f4f43a4e439897cc9b887216fb"}],"package_integrity":[{"filename":"poc-ch4rlygr-1.5.0.tgz","hashes":{"sha1":"0402d71add5f30ff48fb25a2314cb51f207e4940","sha512_sri":"sha512-OIMPKxHlaPalUEVWvETHO3pVfXN+aNda9I+okf1qRWjfPsRom9Quoswosny7EQvRTUcnMvfF6ZesWTiiRusiZA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.5.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/poc-ch4rlygr/v/1.6.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016746","import_time":"2026-08-06T23:25:07.170313738Z","modified_time":"2026-08-06T19:11:41Z","sha256":"15d14c84f5679a5693ff177aa1dd25ba927b3f58fd7f2b2e757605060e178c96","source":"amazon-inspector","versions":["1.5.0"]},{"id":"IN-MAL-2026-016748","import_time":"2026-08-06T23:25:07.306903172Z","modified_time":"2026-08-06T19:11:57Z","sha256":"e318d841681c602bebf435c71e911f64c5908799fd72607164afd5a14089b513","source":"amazon-inspector","versions":["1.3.0"]},{"id":"IN-MAL-2026-016747","import_time":"2026-08-06T23:25:07.224433353Z","modified_time":"2026-08-06T19:11:49Z","sha256":"341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04","source":"amazon-inspector","versions":["1.4.0"]},{"id":"IN-MAL-2026-016749","import_time":"2026-08-06T23:25:07.393623136Z","modified_time":"2026-08-06T19:12:05Z","sha256":"4cb2a37c001854866c3e211a5bdd9a87605e612f1e6b35a593652d652e5d4446","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-016752","import_time":"2026-08-06T23:25:07.531147267Z","modified_time":"2026-08-06T19:12:28Z","sha256":"862b5fd1c8adf96b9936b92e17179f61f423806d9768c8db91de9e1e3d8d48c4","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-016742","import_time":"2026-08-06T23:25:06.904694259Z","modified_time":"2026-08-06T19:09:42Z","sha256":"dde1962aa6971bfb1d042bfb0b96da389f7f727d898d18cab7fd8738bcd960ee","source":"amazon-inspector","versions":["1.6.0"]}]}}