passkeys-react

{"modified":"2026-08-12T15:41:43Z","published":"2026-08-12T15:41:43Z","schema_version":"1.7.4","id":"MAL-2026-13922","summary":"Malicious code in passkeys-react (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd)\npackage.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, current working directory, and the contents of /etc/passwd and /etc/hosts, then POSTs the collected data over HTTPS to the hardcoded subdomain ltivq9rn7t7gkxho4o1micsk6bc20uoj.oastify.com (a Burp Collaborator out-of-band interaction host). The behavior fires automatically as part of a default install and matches an installer-side host reconnaissance and system-file exfiltration pattern; the package's stated purpose (a passkeys React helper) does not require reading /etc/passwd, /etc/hosts, or contacting an OAST endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"passkeys-react"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"5d77406925fc3c844c6b0872048470e61f29f1aabc5f6c2cc09b02c4f13745fb","tlsh":"96412399a2c917330de210c06b0c70853359fa777259a89076cf43969f869f8b7726f3"}],"package_integrity":[{"filename":"passkeys-react-1.0.1.tgz","hashes":{"sha1":"d8993fc153c3e0e5073221fc5ae074b9275832ec","sha512_sri":"sha512-9jGGR+YyCLbRDT1/gbC0cAQyBKtF0vGWUoMpR6tkCYb6cHDREx7+SzLEwkuh+i4onBrGMT14mdCu+AhubdyUHg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/passkeys-react/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017618","import_time":"2026-08-12T15:53:01.430700033Z","modified_time":"2026-08-12T15:41:43Z","sha256":"cce50db3ac46a97bd27f546d029617582b37a2ead027509b0bea35370e47d2bd","source":"amazon-inspector","versions":["1.0.1"]}]}}