pump-segments-sdk

{"modified":"2026-08-18T23:56:38Z","published":"2026-08-18T23:56:38Z","schema_version":"1.7.4","id":"MAL-2026-14186","summary":"Malicious code in pump-segments-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5)\npackage.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info, output of whoami/uname/id/ps aux, cwd, package.json, node_modules listing, /etc/passwd, /etc/shadow, ~/.npmrc, and ~/.npm/_logs, and POSTs the collected data over plain HTTP to a hardcoded oastify.com (Burp Collaborator) subdomain. The package presents itself as a netbsd-x64 esbuild build, which does not match the observed behavior. The read of ~/.npmrc exposes any npm auth tokens present on the installer host, and /etc/shadow read attempts to exfiltrate local password hashes.\n","affected":[{"package":{"ecosystem":"npm","name":"pump-segments-sdk"},"versions":["20.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"f43f439cf39e626e43dfae4d5a716099d040b9197264c12d761860c772116e7a","tlsh":"db6110e485b9023136b3d1e111570003bdb6d1733216eef076cc8a992f5bb2852b79ec"}],"package_integrity":[{"filename":"pump-segments-sdk-20.1.1.tgz","hashes":{"sha1":"268088ccf39e6d8ed4ab240c90aacd17b3fa98e8","sha512_sri":"sha512-h6c9bawnPnB/n4Cgbuj6QToGL6do7xJrL2v1I6BeAQr8cxnsoUFG2sXc9dJfilB1cedLAgvMot8Ck4Wdkj9jyw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pump-segments-sdk/v/20.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018233","import_time":"2026-08-19T00:21:11.412170018Z","modified_time":"2026-08-18T23:56:38Z","sha256":"838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5","source":"amazon-inspector","versions":["20.1.1"]}]}}