cisco-github-simple

{"modified":"2026-09-22T13:56:19Z","published":"2026-09-22T13:56:19Z","schema_version":"1.7.4","id":"MAL-2026-16381","summary":"Malicious code in cisco-github-simple (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205)\nThe package declares a preinstall lifecycle hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp Collaborator subdomain prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com. The package name impersonates Cisco's GitHub namespace, consistent with a dependency-confusion recon beacon targeting internal Cisco builds. There is no legitimate purpose served by the code; installing or building against this package leaks sensitive host and account information to an attacker-controlled out-of-band domain.\n","affected":[{"package":{"ecosystem":"npm","name":"cisco-github-simple"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"21b81e40ffe5e20981e5631c94020f737bfe0cd08d5c34adbed836b7779393fc","tlsh":"5b41259962d917330de210c0670c70802359f9777259a9d076cf43969f869f8b7316f3"}],"package_integrity":[{"filename":"cisco-github-simple-1.0.1.tgz","hashes":{"sha1":"83b0eb6810a24b46ec5e35afe469a66ed5942d97","sha512_sri":"sha512-5bjQTPBe7k5nbAOcVjITN6idfOxKr4eKABSq51PjppsJXU9N6QOzB0NiQpcfp7LJtn5zNCAGmnxWXjFoVIQk1A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cisco-github-simple/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020284","import_time":"2026-09-22T14:19:07.634654822Z","modified_time":"2026-09-22T13:56:19Z","sha256":"2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205","source":"amazon-inspector","versions":["1.0.1"]}]}}