online-header

{"schema_version":"1.7.4","id":"MAL-2026-17420","published":"2026-10-01T14:55:35Z","modified":"2026-10-04T23:42:38.819946460Z","summary":"Malicious code in online-header (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761)\nonline-header@99.0.0 is a dependency-confusion squat (name claimed at version 99.0.0 with an inert main entry) whose `preinstall` lifecycle script runs `node callback.js`. callback.js collects host identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname` install path, Node version, `os.platform()` and `os.arch()` — and POSTs them via `https.request` to the hardcoded Burp Collaborator OAST endpoint `https://bixi2qq8pkzaq6byt1e037kuul0co2cr.oastify.com`, with a DNS-based backup channel to the same subdomain. On any build system that resolves `online-header` from the public registry (for example, an internal package of the same name shadowed by this public release), `npm install` automatically transmits the installer's host identity and internal install path to a third-party collector controlled by whoever provisioned the OAST subdomain. The package's self-description as a 'dependency-confusion test' does not change the behavior: installers receive no notice and no opt-out, and the data lands at an endpoint outside their control.\n\n## Source: ossf-package-analysis (161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc)\nThe OpenSSF Package Analysis project identified 'online-header' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"online-header","ecosystem":"npm"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"648abc9be856dafce010b53ab6273ed0713cc61e889b999e59c0d80b8e37e299","tlsh":"472153e522f4b2752be1efd086632b565652c066350beae0f88d03189bcb62d82335d7"},{"path":"package.json","sha256":"508eaee88cd8f11d305febf68b30fa20172dffa860e4bf1d1ea982186bca6e5f","tlsh":"7dd0a764ac11b83328f996f2493651191174dd1f99481d6da5c6410c81996e68677189"}],"package_integrity":[{"filename":"online-header-99.0.0.tgz","hashes":{"sha1":"986226971f9c0a419b76188585a63924ed286951","sha512_sri":"sha512-bIKIroRqeiZdeUa06MY1Rvmwh3bTI2JLLRfMKCiH3XsMUqFQe/YSPl5C7uUKFbqVf79W8lXLdp0D5AcL0AlkpQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/online-header/v/99.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-01T15:19:28.067690628Z","modified_time":"2026-10-01T14:55:35Z","sha256":"161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc","source":"ossf-package-analysis","versions":["99.0.0"]},{"id":"IN-MAL-2026-020938","import_time":"2026-10-04T23:40:43.951007383Z","modified_time":"2026-10-04T23:22:54Z","sha256":"4b9cc23b20e29ff5e2382e8812e86048148646c43b844f6f73db4581e790f761","source":"amazon-inspector","versions":["99.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}