analytics-v2

{"modified":"2026-08-26T14:18:17Z","published":"2026-08-26T14:18:17Z","schema_version":"1.7.4","id":"MAL-2026-14531","summary":"Malicious code in analytics-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982)\nOn npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction.\n","affected":[{"package":{"ecosystem":"npm","name":"analytics-v2"},"versions":["4.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e3cf31b58720bdcab864d101d372cce245fd591c4de90df22b787b9644352e8e","tlsh":"99513ec516f655251ba7a8494a0f9002a327e0033609de55bfcc8340af9836c9bf0bf6"}],"package_integrity":[{"filename":"analytics-v2-4.0.0.tgz","hashes":{"sha1":"94c96f53fe4903efc35f8b20cc78ed35e502cbed","sha512_sri":"sha512-0NE9spyiripI0WYGvoTvuqCq1epwStsfSGwMsQexoI0I9vpwXcheZOpk8O39sRAd5tP660fLHpEBfCyKpzfxmA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/analytics-v2/v/4.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018751","import_time":"2026-08-26T14:20:36.907679691Z","modified_time":"2026-08-26T14:18:17Z","sha256":"a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982","source":"amazon-inspector","versions":["4.0.0"]}]}}