mt-ts-serverless-starter

{"modified":"2026-08-26T14:18:05Z","published":"2026-08-26T14:18:05Z","schema_version":"1.7.4","id":"MAL-2026-14536","summary":"Malicious code in mt-ts-serverless-starter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53da5b8989180a10122e1e8ab801ab76dc7587761bb58d05377359b8f8e09d52)\npackage.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com. The exfiltration fires unconditionally at install time with no user interaction.\n","affected":[{"package":{"ecosystem":"npm","name":"mt-ts-serverless-starter"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"49c560e08fa3c382958e2d235133aa481142be3ef5e175568b2c35d5eabb387a","tlsh":"3e411395a2d917330dd110c0660c70c52359fa767159a99077cf4296af869f8b7226f3"}],"package_integrity":[{"filename":"mt-ts-serverless-starter-1.0.1.tgz","hashes":{"sha1":"5c16bb79958a9bd48f157c529b055796547d0b61","sha512_sri":"sha512-7WkTFLD1FaYT76COe4Pe7332FJ4DCtkRGQd/F8tdjgFtVRj5Rcq+DNt/DOw8XoL5ZjZzeSPkAsYlBWux7cY9lg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mt-ts-serverless-starter/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018750","import_time":"2026-08-26T14:20:36.866256819Z","modified_time":"2026-08-26T14:18:05Z","sha256":"53da5b8989180a10122e1e8ab801ab76dc7587761bb58d05377359b8f8e09d52","source":"amazon-inspector","versions":["1.0.1"]}]}}