simplewave

{"modified":"2026-10-22T06:10:14Z","published":"2026-10-22T06:10:14Z","schema_version":"1.7.4","id":"MAL-2026-18187","summary":"Malicious code in simplewave (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0)\nsimplewave@0.0.2 declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun with the installer's os.hostname() embedded as the leftmost DNS label. oast.fun is the public Interactsh out-of-band interaction server, used to receive exfiltrated data via DNS/HTTP callbacks. The beacon fires unconditionally on npm install, with no caller consent or configuration. The shipped index.js is a trivial stub providing no advertised functionality, so the manifest-level beacon is the package's entire effect. The host identifier of every machine that installs the package is delivered to a third-party OOB collector controlled by whoever provisioned the oast.fun subdomain token.\n","affected":[{"package":{"ecosystem":"npm","name":"simplewave"},"versions":["0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e8471246cd57d1305b12c3523851f05178e56bbd2d2ab43c181179308b66d643","tlsh":"4ce02df80f80db3b60c40ee406a78026f323c80200042a00e3fb11aa02d82f20c3e48c"}],"package_integrity":[{"filename":"simplewave-0.0.2.tgz","hashes":{"sha1":"5a97802b03f92a9f0fb4dcce29e11adbd742c174","sha512_sri":"sha512-evpJRFgOF3WjrXTV1n+6Ad0pKHFnp+kE1BBZErY7voT58oBBhMEtpksG8wi1Doy9uIKzTT1bNcbcHoV+gHACoA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simplewave/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021566","import_time":"2026-10-22T06:30:23.52812547Z","modified_time":"2026-10-22T06:10:14Z","sha256":"d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0","source":"amazon-inspector","versions":["0.0.2"]}]}}