@cats-cdf/authentication

{"modified":"2026-08-07T01:01:07Z","published":"2026-08-06T23:55:20Z","schema_version":"1.7.4","id":"MAL-2026-13478","summary":"Malicious code in @cats-cdf/authentication (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c)\nThe package's preinstall lifecycle script runs on npm install and collects the installer's local username (whoami), hostname, and public IP address (fetched via ifconfig.me), then transmits them as query-string parameters in an HTTP GET request to a hardcoded subdomain of oast.fun (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun). oast.fun is an out-of-band interaction/callback service commonly used for reconnaissance and exfiltration in dependency-confusion attacks. The behavior fires automatically on default install with no relation to any documented package purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"@cats-cdf/authentication"},"versions":["3.1.1","2.17.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/preinstall.js","sha256":"4275061552723f1d31253e74f931ebac93d9f83b772b3c68a53374c1b4c9dd68","tlsh":"6d01f9f7636553f04fc2cd96854eb58b5317a12a7502bca87cbd0a563b49c0c13f22d5"}],"package_integrity":[{"filename":"authentication-3.1.1.tgz","hashes":{"sha1":"44067ec030eebbba06bd7a44b468c93e7de2043a","sha512_sri":"sha512-iC++nNmO2hZrlxPYyQeaHfHVVxhoedoDFYH+AHxPa2bljcoZT8Yn74EUFBEPhyMtJh7SVxWmAP2VLniLs+t30Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@cats-cdf/authentication/v/3.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@cats-cdf/authentication/v/2.17.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016849","import_time":"2026-08-07T00:59:21.583891527Z","modified_time":"2026-08-06T23:55:43Z","sha256":"404569337a1e5fc46fff2584e052d2f9f99c3cb8d04e5fb3b5c5d633c178e01c","source":"amazon-inspector","versions":["3.1.1"]},{"id":"IN-MAL-2026-016847","import_time":"2026-08-07T00:59:21.366232668Z","modified_time":"2026-08-06T23:55:20Z","sha256":"c38c7998a850ceb03e1e9795f5e815bc564a1db2d77bdffb77d22bf9ef2dd608","source":"amazon-inspector","versions":["2.17.1"]}]}}