kmf-i18n

{"schema_version":"1.7.4","id":"MAL-2026-17747","published":"2026-10-09T19:10:42Z","modified":"2026-10-11T14:19:58.629756409Z","summary":"Malicious code in kmf-i18n (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c)\nkmf-i18n@100.100.100 is published with the version-number and behavior shape of a dependency-confusion reconnaissance beacon rather than an i18n library. The tarball ships a Linux x64 N-API binary at prebuilds/linux-x64/addon.node with no corresponding source, no binding.gyp, and no build step. package.json declares scripts.postinstall = \"node postinstall.js\", and postinstall.js require()s that prebuilt.node binary, so the native code is loaded automatically on npm install. The addon opens a raw TCP socket to the hardcoded bare IP 64.181.165.115 on port 80 and sends an HTTP/1.0 POST to /dc with body h=<HOSTNAME>&p=<npm_package_name>&u=<unused>&r=<npm_config_registry>, reading those values from the installer's environment. The exfiltrated npm_config_registry value discloses internal/private npm registry URLs, which is the characteristic signal of dependency-confusion target reconnaissance. The addon exposes no i18n functionality consistent with the package's declared purpose; its only observable behavior is the install-time beacon. The main entry also require()s the same binary, so merely importing the package re-triggers the native load path.\n\n## Source: ossf-package-analysis (c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1)\nThe OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"kmf-i18n","ecosystem":"npm"},"versions":["100.100.102","100.100.101","100.100.100"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"prebuilds/linux-x64/addon.node","sha256":"1798796310908fa36529d480c1c8eb644195a9539cb574531b3eb3278458f1d5","tlsh":"2972251bb361c93fc4e84334054b5a6572b6a4746b7313231f04a67e3ce27985e7aa8f"},{"path":"index.js","sha256":"8222b8169ee86f25cdccd84d340340060ae3f0cff55e2ea9d344d7c332733b71"}],"package_integrity":[{"filename":"kmf-i18n-100.100.101.tgz","hashes":{"sha1":"e158594cf93f61363356c55576974627c259443d","sha512_sri":"sha512-14j1jdjA2we2UA6m7JlQSCwoGr062MaCIpGHT5FVuuOhQZPl86YrKYzxG8cf7ADS+6a40PPwlZZbDLXNRacUew=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-i18n/v/100.100.101"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-i18n/v/100.100.102"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/kmf-i18n/v/100.100.100"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-09T19:15:19.485365629Z","modified_time":"2026-10-09T19:10:42Z","sha256":"c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1","source":"ossf-package-analysis","versions":["100.100.102"]},{"id":"IN-MAL-2026-021418","import_time":"2026-10-11T14:18:04.003362059Z","modified_time":"2026-10-11T13:56:29Z","sha256":"6ea0a9b64d2c7100bfc55c2849fc7b51fe7c967850bfc5a17a0295a4bbfa85c7","source":"amazon-inspector","versions":["100.100.101"]},{"id":"IN-MAL-2026-021416","import_time":"2026-10-11T14:18:03.756742815Z","modified_time":"2026-10-11T13:56:09Z","sha256":"b0331a73dd7ea6088c8c63d37751490d0834a305d6a7ddb6cd55de2e0741ff3e","source":"amazon-inspector","versions":["100.100.102"]},{"id":"IN-MAL-2026-021425","import_time":"2026-10-11T14:18:04.542531921Z","modified_time":"2026-10-11T13:57:29Z","sha256":"ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c","source":"amazon-inspector","versions":["100.100.100"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}