fund-calculator

{"modified":"2026-08-24T05:06:25Z","published":"2026-08-24T05:06:25Z","schema_version":"1.7.4","id":"MAL-2026-14391","summary":"Malicious code in fund-calculator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672)\nPackage declares a preinstall script (`node index.js`) that fires unconditionally on `npm install`. index.js reads installer-side identifiers via `os.hostname()`, `os.userInfo()`, `INIT_CWD`, home directory, and the parent project's package.json (name/author/repository/homepage), and additionally resolves the installer's public IP via https requests to api.ipify.org, icanhazip.com, and ifconfig.me. The collected data is transmitted to the hardcoded callback `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun` over three channels: HTTP POST to port 80, HTTPS POST to port 443 on path `/poc/${uuid}`, and DNS resolution of hex-encoded payload chunks (Buffer.from(body).toString('hex') split into 60-character labels) emitted as subdomains under the callback host to bypass egress filters that permit DNS but block outbound HTTP. The 999.9.12 version number and package name are consistent with a dependency-confusion name-squat designed to win resolution against a private internal package of the same name.\n","affected":[{"package":{"ecosystem":"npm","name":"fund-calculator"},"versions":["999.9.12"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6ae2050935c288667b414cbb7ed576d5167b9c4954973aaee3c7cd6ad34b473d","tlsh":"5fe1a69712fa203012623ab8279f58957333d523338aebd0b98d03645fd727d53b26da"}],"package_integrity":[{"filename":"fund-calculator-999.9.12.tgz","hashes":{"sha1":"354776b482dc605b7a50ab98177314fd91c2c34d","sha512_sri":"sha512-ClCcU0VozrhglBAsSIkB+UxZ8qZogDyCq2cK0VDqpP31ExXCoStIAG+W9/SdLViDAvvpcHBipH0mJKY2s2szSA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fund-calculator/v/999.9.12"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018602","import_time":"2026-08-24T05:20:13.716188076Z","modified_time":"2026-08-24T05:06:25Z","sha256":"52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672","source":"amazon-inspector","versions":["999.9.12"]}]}}