okra-cloud-cdk

{"schema_version":"1.7.4","id":"MAL-2026-17436","published":"2026-09-30T07:10:23Z","modified":"2026-10-04T23:42:38.765322773Z","summary":"Malicious code in okra-cloud-cdk (npm)","details":"okra-cloud-cdk is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version (100.0.0) so it outranks private-registry versions, and runs `node setup.js || true` as a preinstall script on npm install. setup.js sends the hostname, username, working directory, OS, architecture, Node.js version and configured npm registry, with a per-package tracking token, in an HTTPS POST to `https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`. The npm account amel10 published okra-cloud-cdk and 9 similar packages within two minutes on 2026-09-30, all with the same setup.js.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (84a86d5a0d96567fc1ab65c8f61ab1610b8488859dd53ade8a7a05a86389d371)\nokra-cloud-cdk@100.0.0 ships a `preinstall` lifecycle script (`setup.js`) that runs automatically on `npm install`. The script collects installer-side identifiers — hostname (`os.hostname()`), username (`os.userInfo().username`), current working directory (`process.cwd()`), platform, architecture, Node version, and the configured npm registry URL (`npm_config_registry`) — and POSTs them along with a hardcoded token to a hardcoded AWS API Gateway endpoint at https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook. The package's declared main is a trivial `zeroPad` stub whose functionality (`Pad number with leading zeros`) is unrelated to the package name `okra-cloud-cdk`, and the implausibly high version number (100.0.0) is consistent with an attempt to win resolution against an internal package of the same name. The exfiltrated `npm_config_registry` value in particular discloses internal/private registry hostnames, which are the identifying signal used to select follow-up dependency-confusion targets.\n","affected":[{"package":{"name":"okra-cloud-cdk","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["100.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"c8b43cae12b084d6a8f0270eaae86e202571f31d61cb46f1841c2aab080dc45c","tlsh":"1301f4f4d1e0d5b53ab891c4f290b44b9377d1183007a5e0c8e841907f85af809738f2"}],"package_integrity":[{"filename":"okra-cloud-cdk-100.0.0.tgz","hashes":{"sha1":"bbe94243ac24255bb9fa554cacd26bd67117d9ee","sha512_sri":"sha512-BPlmQ+h5E5bz1Q+vIJSQsKSnbZsCM3z/m94JAlRDi1FzccXubIUU79qKNCdqFrdEZ8gRTJe57mGLDIzMsJ7R+A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/okra-cloud-cdk"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/okra-cloud-cdk/v/100.0.0"}],"database_specific":{"iocs":{"domains":["s85r5k14qk.execute-api.us-east-1.amazonaws.com"],"files":[{"digests":{"sha256":"46efc596e4c935e6ad56282108b76ad18c588cb78558b39fce4e67fb36b0e511"},"note":"preinstall: node setup.js || true","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"c8b43cae12b084d6a8f0270eaae86e202571f31d61cb46f1841c2aab080dc45c"},"note":"Executed by the preinstall script.","paths":["setup.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-020934","import_time":"2026-10-04T23:40:43.555068153Z","modified_time":"2026-10-04T23:22:14Z","sha256":"84a86d5a0d96567fc1ab65c8f61ab1610b8488859dd53ade8a7a05a86389d371","source":"amazon-inspector","versions":["100.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}