test-account-portal-fe

{"schema_version":"1.7.4","id":"MAL-2026-17748","published":"2026-10-09T19:10:36Z","modified":"2026-10-13T07:34:10.911152470Z","summary":"Malicious code in test-account-portal-fe (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca)\nnpm package test-account-portal-fe@100.100.101 ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose (\"Frontend utilities\") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=<hostname>&u=<unix-user>&p=<npm_package_name>&r=<npm_config_registry>, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.\n\n## Source: ossf-package-analysis (5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907)\nThe OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"test-account-portal-fe","ecosystem":"npm"},"versions":["100.100.102","100.100.100","100.100.101"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"prebuilds/linux-x64/addon.node","sha256":"d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906","tlsh":"c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a"},{"path":"package.json","sha256":"86fc6110d043ca50d2fee85029e57fb3e90d6d4d34388d0c53e5a621ece55f01","tlsh":"b2d012140e33963378c04ba55d275a0e65720d6f4004b41c13e3215982dabfb4cbb31e"}],"package_integrity":[{"filename":"test-account-portal-fe-100.100.100.tgz","hashes":{"sha1":"0841039ad4b8e151fec618983a25fd7758e59af1","sha512_sri":"sha512-Mml9T4BaC/IR7y0V675pQLyh70mkuEiDSCjeHtDNZmMP/eNTFYzf9AyW+/VUaFwTPhOA+w/d1h4vcjUyQP2ijA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-account-portal-fe/v/100.100.100"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-account-portal-fe/v/100.100.102"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-account-portal-fe/v/100.100.101"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-09T19:15:19.362264369Z","modified_time":"2026-10-09T19:10:36Z","sha256":"5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907","source":"ossf-package-analysis","versions":["100.100.102"]},{"id":"IN-MAL-2026-021423","import_time":"2026-10-11T14:18:04.381155092Z","modified_time":"2026-10-11T13:57:11Z","sha256":"63911c5f393d2276fffe11b7d465b04704722dc852a79fbfbd63b5f8dbd812b8","source":"amazon-inspector","versions":["100.100.100"]},{"id":"IN-MAL-2026-021378","import_time":"2026-10-11T14:18:00.739376595Z","modified_time":"2026-10-11T13:50:23Z","sha256":"d9191f0c04c63fc8aa02af2a97681b15cfd241ead915ee30f0b79baa0c4e0200","source":"amazon-inspector","versions":["100.100.102"]},{"id":"IN-MAL-2026-021469","import_time":"2026-10-13T07:32:01.72436852Z","modified_time":"2026-10-13T07:08:59Z","sha256":"0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca","source":"amazon-inspector","versions":["100.100.101"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}