@gsas/gsas-sdk

{"modified":"2026-08-24T16:39:13Z","published":"2026-08-24T16:39:13Z","schema_version":"1.7.4","id":"MAL-2026-14420","summary":"Malicious code in @gsas/gsas-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2242b683433d5fe37b3997185d251799a4606a456e516da08586775d11f0cb7e)\n@gsas/gsas-sdk@999.9.15 is a high-version public-registry squat targeting an internal `@gsas/gsas-sdk` name. package.json declares `preinstall: node index.js`, and index.js runs on install to collect the installer's hostname, username, home directory, cwd, local/public/resolver IPs, npm registry URL, CI platform with repo/actor/run/workflow/runner, AWS region, git email domain, and the consuming project's name/author/repo/homepage. It also spawns `gh api user --jq.login`, `npm whoami`, and `git config user.email` to capture the developer's authenticated GitHub login, npm login, and email. The collected JSON is hex-encoded, split into 60-character chunks emitted as DNS subdomain queries under `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun`, and additionally POSTed over HTTP and HTTPS to the same host (path `/poc/<uuid>`). Public-IP discovery calls out to api.ipify.org, icanhazip.com, and ifconfig.me. Comments in the file describe the multi-channel design as intended to survive corporate egress filtering. An `AUTHORISED SECURITY RESEARCH` self-label appears in the source but does not correspond to installer consent.\n","affected":[{"package":{"ecosystem":"npm","name":"@gsas/gsas-sdk"},"versions":["999.9.15"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"2c139fc213819236d576cb1952b0153d0f7c75539d7ea98d2404db5f2db490d6","tlsh":"ba12c79702f6243013e265682e8784d4776bd517378aebf0b94d47601fee26843b37ea"}],"package_integrity":[{"filename":"gsas-sdk-999.9.15.tgz","hashes":{"sha1":"f24de22c722f6c88824d6ce066d7f874ab80827d","sha512_sri":"sha512-kYvYaAe3qUq204TxDEohW7xbZkRVXq2c3N9mWeCdnkVxut307gDc75ufGeKh4CNPZKJXYVJuEb9uJGmxyC2zyA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@gsas/gsas-sdk/v/999.9.15"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018630","import_time":"2026-08-24T16:49:13.524152308Z","modified_time":"2026-08-24T16:39:13Z","sha256":"2242b683433d5fe37b3997185d251799a4606a456e516da08586775d11f0cb7e","source":"amazon-inspector","versions":["999.9.15"]}]}}