remove-bg-serverless-azure

{"modified":"2026-08-24T16:44:46Z","published":"2026-08-24T16:44:46Z","schema_version":"1.7.4","id":"MAL-2026-14438","summary":"Malicious code in remove-bg-serverless-azure (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e)\npackage.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostname(), os.userInfo(), the user home directory, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, and POSTs the collected data over HTTPS to the hardcoded host 7iqn7pls4ly6w8valba0xcxygpmha7yw.oastify.com (a Burp Collaborator / OAST subdomain used as an attacker-controlled callback). Installing the package causes installer-side identifiers and sensitive system files to be sent to an external attacker endpoint on install.\n","affected":[{"package":{"ecosystem":"npm","name":"remove-bg-serverless-azure"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d0fcf3c1c47dbf9a78f4c0d5ccd12d4a296bc90dce69675763193e838376b318","tlsh":"9c41259952d917330dd210c06a0c70843399fa777169989076cf42969f869f8b7726f3"}],"package_integrity":[{"filename":"remove-bg-serverless-azure-1.0.1.tgz","hashes":{"sha1":"002c0b9c80997d495682454d59b1a0db5eaf60da","sha512_sri":"sha512-9tFhTsivaayH84skx8nrPPwqVHNTovPiZ5lTBh0Dt0/fmGUAvsYKjMIj9Wbeg9RPooyGlSP9BGi18uJCMkdlvQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/remove-bg-serverless-azure/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018641","import_time":"2026-08-24T16:49:14.325282905Z","modified_time":"2026-08-24T16:44:46Z","sha256":"dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e","source":"amazon-inspector","versions":["1.0.1"]}]}}