checkmate-remediation-assistant

{"schema_version":"1.7.4","id":"MAL-2026-17572","published":"2026-10-05T09:02:39Z","modified":"2026-10-07T06:20:52.903543885Z","summary":"Malicious code in checkmate-remediation-assistant (npm)","details":"checkmate-remediation-assistant@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished about two minutes later; the same account published with-cte the same day with the same index.js and a different Collaborator subdomain.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4)\nThe package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com). The destination is an out-of-band interaction server not associated with any declared publisher or documented package purpose, and the exfiltration fires automatically on default install without user interaction.\n","affected":[{"package":{"name":"checkmate-remediation-assistant","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"c3b9a6b9837af57b17acac41d279a905d70365d3d9e57284c8c217b7508d78ca","tlsh":"5d412395a2c917330dd210c06a1c70843359fa777269a8d076cf42969f869f8b7326f3"}],"package_integrity":[{"filename":"checkmate-remediation-assistant-1.0.0.tgz","hashes":{"sha1":"1116b68d5c21ed65ff06b2edc7dfad7181636bf7","sha512_sri":"sha512-Svgam2vzDqxOjZDANOlRGP+NDkxy6eyoq3NGdsJt2sUH+9YYxgnL8cxwM5DZG6T86bcT5JUS1tbJtHIYrCIrLw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkmate-remediation-assistant/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkmate-remediation-assistant"}],"database_specific":{"iocs":{"domains":["9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com"],"files":[{"digests":{"sha256":"2a7881b42271bb9aa87855e0af958857c1b6acaa670150481baef0847dd78f43"},"note":"preinstall script runs `node index.js`.","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"c3b9a6b9837af57b17acac41d279a905d70365d3d9e57284c8c217b7508d78ca"},"note":"Executed by the preinstall script of checkmate-remediation-assistant@1.0.0.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com/"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021081","import_time":"2026-10-05T16:22:57.119740865Z","modified_time":"2026-10-05T16:15:03Z","sha256":"c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}