fund-portfolio

{"schema_version":"1.7.4","id":"MAL-2026-14381","published":"2026-08-23T11:00:52Z","modified":"2026-08-24T05:22:17.044025273Z","summary":"Malicious code in fund-portfolio (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17)\nPackage declares `scripts.preinstall`: `node index.js`, causing index.js to run automatically on `npm install`. The script collects hostname, username, home directory, INIT_CWD, local IPv4, public egress IP (via api.ipify.org, icanhazip.com, ifconfig.me), DNS resolver IP and client subnet (via o-o.myaddr.l.google.com), and the parent project's package.json fields (name, author, repository, homepage). The collected JSON is exfiltrated to the hardcoded callback host `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun` (Interactsh/OAST) via DNS-chunked queries and HTTPS POST to `/poc/<uuid>`. The unscoped name is published at version 999.9.12 to defeat internal resolvers that fall back to the public npm registry, so any build referencing `fund-portfolio` without a private-registry pin will resolve to and execute this payload.\n\n## Source: ossf-package-analysis (ffad2f6c37441c2924e67b1d506d9c26dc9cb2fae325b74a596102ea5ed403bf)\nThe OpenSSF Package Analysis project identified 'fund-portfolio' @ 999.9.12 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"fund-portfolio","ecosystem":"npm"},"versions":["999.9.12"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"36c2fc4a3aa31382ee5b6bc83308f8ee918c34d4d7abe512a45e67fb9e5e2557","tlsh":"19e1b75712fa203012623ab8279f58957333d523338aebd0b98d03645fd727d53b26da"},{"path":"README.md","sha256":"4135538edb5543ca2e841d648b105f0a6fb387b32eaecb1f84e3cc1e5857e9bd","tlsh":"da51d8ab4791133154a249b2915d7add4773c078602a4cd0a0aee30da6637a8473e1ea"}],"package_integrity":[{"filename":"fund-portfolio-999.9.12.tgz","hashes":{"sha1":"c539fd6223590b833056a21b43bbb8fe73040eb6","sha512_sri":"sha512-j2x1u6jKBOJcYkXTTfooQxQoX9kmtXnEZSI1WxFklJvKcafKTXPdXHJziWJsdGWGUSf5riOwCA4yBPfxM4Bojg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fund-portfolio/v/999.9.12"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-23T11:09:11.011429279Z","modified_time":"2026-08-23T11:00:52Z","sha256":"ffad2f6c37441c2924e67b1d506d9c26dc9cb2fae325b74a596102ea5ed403bf","source":"ossf-package-analysis","versions":["999.9.12"]},{"id":"IN-MAL-2026-018589","import_time":"2026-08-24T05:20:12.455986364Z","modified_time":"2026-08-24T05:04:31Z","sha256":"27ba065e8759299d381ed1c7abd5e7721037b4ea969a384a9e70cfb6bb799e17","source":"amazon-inspector","versions":["999.9.12"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}