@usaa-grp-personal-profile/personal-profile-common

{"modified":"2026-08-23T03:15:23Z","published":"2026-08-23T03:15:23Z","schema_version":"1.7.4","id":"MAL-2026-14370","summary":"Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a)\nPackage published to public npm under an internal-looking scope (@usaa-grp-personal-profile) at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry. package.json declares preinstall and postinstall hooks that execute beacon.js on npm install. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), hex-encodes them into DNS labels, and issues dns.lookup queries against a subdomain of oastify.com (Burp Collaborator out-of-band service), transmitting installer host, user, and working-directory identifiers to a third-party OAST endpoint on every install. The exfiltration fires automatically without user invocation and reaches an attacker-controllable Collaborator subdomain regardless of any research/PoC framing in the package metadata.\n","affected":[{"package":{"ecosystem":"npm","name":"@usaa-grp-personal-profile/personal-profile-common"},"versions":["999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beacon.js","sha256":"191a1e877b13ebc08056d6eb468579d409d5d20942ea05ebf29b5069f36d7e09","tlsh":"f411462a8d64b57533a321805b9f11c2b52283660085eb51945b9258ee8a6f45b32eed"},{"path":"package.json","sha256":"897c1acd2eee979fe94730794d609f06654dc9acc83befd8493c0dafcf7f71b5","tlsh":"2ce0ab698c142d2334ca7ed16873a50f21764e9b31642c0402db4098118d7aa86ffa3f"}],"package_integrity":[{"filename":"personal-profile-common-999.0.0.tgz","hashes":{"sha1":"78101cf752c260758ecc125a19a50ded1a5425b5","sha512_sri":"sha512-gfg4xFUR14K049poHWCwwsk7JCvn9b9h0GfeUzlSYnSzPDRfnJxe/QcCzZH4jI28Hlv7hSjcN9j3tJ3s9L5aGw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@usaa-grp-personal-profile/personal-profile-common/v/999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018574","import_time":"2026-08-23T03:25:56.668720026Z","modified_time":"2026-08-23T03:15:23Z","sha256":"de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a","source":"amazon-inspector","versions":["999.0.0"]}]}}