stillm4ddpocs-rtest-alpha

{"modified":"2026-08-23T03:27:44Z","published":"2026-08-23T03:13:15Z","schema_version":"1.7.4","id":"MAL-2026-14377","summary":"Malicious code in stillm4ddpocs-rtest-alpha (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839)\npackage.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP (via https://api.ipify.org, https://icanhazip.com, https://ifconfig.me), DNS-resolver IP, hostname, OS username, home directory, cwd, and the parent project's package.json name/author/repository/homepage, then transmits the JSON to the hardcoded callback da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun via three channels: HTTP POST on:80, HTTPS POST on:443, and DNS TXT queries whose labels carry the hex-encoded payload split into 60-character chunks. The DNS covert channel and hex chunking are structured to bypass egress filtering that blocks outbound HTTP. The package's self-description as 'authorised security research' does not gate execution; any project that resolves this name at install time transmits the data without consent. The 999.9.9 version and lure name are consistent with a dependency-confusion probe.\n","affected":[{"package":{"ecosystem":"npm","name":"stillm4ddpocs-rtest-alpha"},"versions":["999.9.10","999.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"42cf30097f9b9c76569c50f4c64dad915fdd3e45b60beddb3d3e3f154d1496e1","tlsh":"a6e1a59712fa203012623aa8279f58957333d523338aebd0b98d43645fd727d53b26da"}],"package_integrity":[{"filename":"stillm4ddpocs-rtest-alpha-999.9.10.tgz","hashes":{"sha1":"cbeaea674c33a96e0a1f5db8ba8553c8d363919f","sha512_sri":"sha512-spxl1hhKYLkwpYY/fIQWr9vpqoayntptLdx2TYTTfVmRDGL7uquzeBpvCaDGuL8e7ZV3kLStqc0spXV3IyjTmA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stillm4ddpocs-rtest-alpha/v/999.9.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/stillm4ddpocs-rtest-alpha/v/999.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018559","import_time":"2026-08-23T03:25:55.266989026Z","modified_time":"2026-08-23T03:13:15Z","sha256":"1838ad5b8199e05fbd2be46a4eeba578cbe40cf798b243fbc378e4ec4a84a8d9","source":"amazon-inspector","versions":["999.9.10"]},{"id":"IN-MAL-2026-018561","import_time":"2026-08-23T03:25:55.452191892Z","modified_time":"2026-08-23T03:13:29Z","sha256":"47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839","source":"amazon-inspector","versions":["999.9.9"]}]}}