gaarf-bq

{"modified":"2026-08-19T03:48:25Z","published":"2026-08-19T03:48:25Z","schema_version":"1.7.4","id":"MAL-2026-14237","summary":"Malicious code in gaarf-bq (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0)\nOn npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.platform, process.arch, Node version, and package metadata) and POSTs them to a hardcoded endpoint at vpx0x956.instances.poc.jchunt.top (path /gaarf-bq) via https.request. The destination is not caller-configurable and is not related to any documented purpose of the package. The package name resembles Google's ads-api-report-fetcher (gaarf) BigQuery component, consistent with dependency-confusion scaffolding that lures internal builds into resolving this public name and beaconing back host fingerprints. A self-description as a security-research canary does not change the observed behavior: installer-owned identifiers leave the machine to an author-controlled host without opt-in.\n","affected":[{"package":{"ecosystem":"npm","name":"gaarf-bq"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"17d68acc5a2cfeb9b7b80d337da5f33611463335234aeca36ff3bbddf52accb1","tlsh":"8401d3d5d1b95a7557f8629068f0af0693fbf223370624b67ac454e92f8d1f5003119d"}],"package_integrity":[{"filename":"gaarf-bq-1.0.0.tgz","hashes":{"sha1":"ba8af3ee332f063283de570669d16e8947d5b3cf","sha512_sri":"sha512-ydFpDxt5v8cEZ3DkYDHdpNAFlgmxuGnmfh5sO5FAbFIE9GwlldLutw100KukRmSUCzj4UPjCuukXS5Z6hwUfJg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gaarf-bq/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018338","import_time":"2026-08-19T03:49:31.048642106Z","modified_time":"2026-08-19T03:48:25Z","sha256":"841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0","source":"amazon-inspector","versions":["1.0.0"]}]}}