kmf-bootstrap

{"schema_version":"1.7.4","id":"MAL-2026-17746","published":"2026-10-09T19:10:34Z","modified":"2026-10-11T14:19:58.622852153Z","summary":"Malicious code in kmf-bootstrap (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74)\nOn npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npm_package_name and issues DNS resolutions for a label of the form <host>.<pkg>.db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me, leaking those identifiers to an Interactsh (oast.me) collaborator over DNS. Second, postinstall.js require()s a shipped Linux x64 native addon at prebuilds/linux-x64/addon.node that calls gethostname() and getpwuid()->pw_name and reads the npm_package_name and npm_config_registry environment variables, then opens a raw socket and sends an HTTP POST with body h=<host>&u=<user>&p=<pkg>&r=<registry> to the bare IP 64.181.165.115 (Host header 64.181.165.115, path /dc, HTTP/1.0, no TLS). The destination is a bare IP with no relation to the package publisher and the npm_config_registry value can disclose a private/internal registry URL from the installer's.npmrc. The native component is opaque code auto-executed during install with host-level network egress. The package name resembles the common 'bootstrap' naming convention, consistent with a dependency-confusion / typosquat lure whose purpose is to beacon successful installs and private registry metadata.\n\n## Source: ossf-package-analysis (4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b)\nThe OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"kmf-bootstrap","ecosystem":"npm"},"versions":["100.100.102","100.100.103","100.100.106","100.100.101","100.100.100"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ad83f21106b39d76f42ab4914cf4f2c718774afbc56db120903cfc774cba9c43","tlsh":"97f0e5aa4a7055a01a97120dd33f680aa8e7f1276c8a95407e9d66910f7061222511f8"}],"package_integrity":[{"filename":"kmf-bootstrap-100.100.106.tgz","hashes":{"sha1":"c33c469662a02914b6e599eff5771311d5aafbd3","sha512_sri":"sha512-2rRl/0EjP1UAqNE8YO1cyEogeuJibH1LNXtNdZzXy/8yp2KSVbrABL2soJgWoM6mSp6t6QKpI2/Ew/dcJLTHjg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-bootstrap/v/100.100.106"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-bootstrap/v/100.100.101"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-bootstrap/v/100.100.103"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-bootstrap/v/100.100.102"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-bootstrap/v/100.100.100"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-09T19:15:19.265428863Z","modified_time":"2026-10-09T19:10:34Z","sha256":"4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b","source":"ossf-package-analysis","versions":["100.100.102"]},{"import_time":"2026-10-09T19:41:44.128123577Z","modified_time":"2026-10-09T19:25:54Z","sha256":"cc9f15e56fb0bf13a7c0bb8ebfa0eeeaa376629272d6fed9073b9c338e1c6862","source":"ossf-package-analysis","versions":["100.100.103"]},{"id":"IN-MAL-2026-021398","import_time":"2026-10-11T14:18:02.341341906Z","modified_time":"2026-10-11T13:53:23Z","sha256":"2405275a8f22c4e8d737c5bb93149a073ddecb6a6daf67715cb4bc2218f76161","source":"amazon-inspector","versions":["100.100.106"]},{"id":"IN-MAL-2026-021385","import_time":"2026-10-11T14:18:01.319831262Z","modified_time":"2026-10-11T13:51:32Z","sha256":"746ee8923cc246b2816dd79a756552ce7975ae9305f195b502f9225a348e00ec","source":"amazon-inspector","versions":["100.100.101"]},{"id":"IN-MAL-2026-021388","import_time":"2026-10-11T14:18:01.54674888Z","modified_time":"2026-10-11T13:51:57Z","sha256":"956976b01563579f32919e883c10229d2cf459fa2253ca34bd164fe83016a567","source":"amazon-inspector","versions":["100.100.103"]},{"id":"IN-MAL-2026-021413","import_time":"2026-10-11T14:18:03.53680973Z","modified_time":"2026-10-11T13:55:39Z","sha256":"b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74","source":"amazon-inspector","versions":["100.100.102"]},{"id":"IN-MAL-2026-021426","import_time":"2026-10-11T14:18:04.609307912Z","modified_time":"2026-10-11T13:57:41Z","sha256":"dbbe7e819b6a360576d8c7ea55ef5da42e2bbb24596548235569fa9f8df6d646","source":"amazon-inspector","versions":["100.100.100"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}