idx_form_script

{"schema_version":"1.7.4","id":"MAL-2026-16243","published":"2026-09-16T16:13:49Z","modified":"2026-09-17T14:22:19.757254899Z","summary":"Malicious code in idx_form_script (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3)\nidx_form_script@999.0.2 is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal package names. package.json declares a postinstall hook that runs callback.js, which auto-executes on npm install. callback.js requires os, https, http, and child_process, then calls collectSystemInfo() to gather os.userInfo, os.hostname, uid/gid, homedir, platform, cwd, local IP, and external IP (via https.get to api.ipify.org). It reads CI/CD credential environment variables including AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD, GITHUB_REPOSITORY, and GITHUB_ACTOR, and includes their values or presence flags in a JSON payload. The payload is POSTed to a hardcoded Discord webhook at discord.com/api/webhooks/1549797176794943579/..., with an additional DNS-based exfil channel. The package's self-labeling as an 'authorized PoC' is author-controlled cover-story text and does not change the observed behavior: any organization that resolves this name from the public registry will run installer-side reconnaissance and ship credential-context data to an attacker-controlled endpoint.\n\n## Source: ossf-package-analysis (59d074c4d6bd941d9586764043d556a83d301711c58eb661d57d63fa06ebec60)\nThe OpenSSF Package Analysis project identified 'idx_form_script' @ 999.0.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"idx_form_script","ecosystem":"npm"},"versions":["999.0.4","999.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"354888ccdd6aa9c7e98955896c6d39d8a52f0bb89331ccaa6ff83ee8b3aa98d4","tlsh":"ea12d9a566b1161005e347902a1fa416327af1572756deb0fbdc43182fc0b7c93f2eba"},{"path":"package.json","sha256":"6da76425956f8b74ce599595b10acba714e5fc143759f597297fabdc8c341be8","tlsh":"cae0c2145e225a232ac02746186aa14266209f2b04047c095bcf582c82deab348fa31d"}],"package_integrity":[{"filename":"idx_form_script-999.0.2.tgz","hashes":{"sha1":"2cc5fd747174b924bc553eb9672fbd403d19cdbc","sha512_sri":"sha512-KQnoAwqFuAXnbRoFGHhTW/w5DhiBLKCq8PIpLnvyD2JuvmhTzGlsvT3wK7d+QwcImdkCJcFrCPSOANEtyH/nNQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/idx_form_script/v/999.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idx_form_script/v/999.0.4"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-16T21:38:33.853489979Z","modified_time":"2026-09-16T16:13:49Z","sha256":"59d074c4d6bd941d9586764043d556a83d301711c58eb661d57d63fa06ebec60","source":"ossf-package-analysis","versions":["999.0.4"]},{"id":"IN-MAL-2026-020121","import_time":"2026-09-17T14:20:23.201857937Z","modified_time":"2026-09-17T14:16:53Z","sha256":"3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3","source":"amazon-inspector","versions":["999.0.2"]},{"id":"IN-MAL-2026-020113","import_time":"2026-09-17T14:20:22.82614053Z","modified_time":"2026-09-17T14:10:57Z","sha256":"bb0ddc6e4f1d03b67fad8796ca1446a3c0e90cb9cf09fab732f39d263638c54a","source":"amazon-inspector","versions":["999.0.4"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}