message-compiler

{"modified":"2026-08-24T05:08:27Z","published":"2026-08-24T05:08:27Z","schema_version":"1.7.4","id":"MAL-2026-14392","summary":"Malicious code in message-compiler (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417)\nThe package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID and related), and issues an HTTPS GET to a hardcoded webhook.site collector URL carrying those fields. It additionally performs a DNS lookup of a subdomain constructed from os.hostname() under a hardcoded oastify.com (Burp Collaborator) domain, exfiltrating the installer's hostname via DNS. The package name typosquats the scoped @intlify/message-compiler package and its only functional code is this beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"message-compiler"},"versions":["9.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vishu.js","sha256":"b5005ec0e3db205675c8b69ca8f97ac0dfa65431ff4123aa21025ffb644496fd","tlsh":"3731424cb2f7821004f363c8161b941e715be1533325cd917a9c02521fbad3882e3bd8"},{"path":"package.json","sha256":"ac069f13545c51cae363c007e4303766e71a657c1042e62c37d0760e933f1dfc","tlsh":"b2d0c2344a11a62726c10a921d16504673a08f2f11443c096bdf142c414f7b798bf32e"}],"package_integrity":[{"filename":"message-compiler-9.2.0.tgz","hashes":{"sha1":"1902dda6ee2f5bc429bac1924459618387ada58b","sha512_sri":"sha512-ZsVDKU0BSpGf34fE9KWlkZZJ83zjVZkl8zgEsAPaco1jmkg/JL0/mzWQybf/05+fb77b0qlG59MUw1aWI5vm5Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/message-compiler/v/9.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018616","import_time":"2026-08-24T05:20:15.051851437Z","modified_time":"2026-08-24T05:08:27Z","sha256":"f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417","source":"amazon-inspector","versions":["9.2.0"]}]}}