stripe-internal-utils

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-20T14:47:34Z","schema_version":"1.7.4","id":"MAL-2026-4184","summary":"Malicious code in stripe-internal-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6add7fd3034c5b0d00e39e2cbfeb7c664085ef412612b53ebe9fd81767449be)\npackage.json declares a postinstall hook that auto-fires on `npm install` and performs reconnaissance + exfiltration against the installer. The inline `node -e` payload fetches the installer's public IP from api.ipify.org, executes `id || ver && whoami && hostname` via child_process.exec, and POSTs a JSON body containing the timestamp, USERDOMAIN/USERDNSDOMAIN/COMPANY environment variables, public IP, hostname, current working directory, and shell command output to a hardcoded interactsh beacon at lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun over HTTP. The package's own description self-identifies as 'Full RCE PoC -osama', and the package name impersonates the Stripe brand to lure installers into a name they would plausibly trust. Any developer or build system running `npm install stripe-internal-utils` leaks identifying host and user information to the attacker.\n\n## Source: ossf-package-analysis (b89c3b9d4dee2f11d05bf97a5338eeb6c5b1b2679157feed7984ab3e97d64ddf)\nThe OpenSSF Package Analysis project identified 'stripe-internal-utils' @ 8.2.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"stripe-internal-utils"},"versions":["8.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["api.ipify.org","lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun"],"evidence_files":[{"path":"package.json","sha256":"7f9c317e40040c866cfb82805d587a556ac3186d977c9212c904d628a4fd0d89","tlsh":"031132f19980ebfaa3d153f87956d405e963e70b61218cb0a86c1b818b891b051abfdc"}],"package_integrity":[{"filename":"stripe-internal-utils-8.2.0.tgz","hashes":{"sha1":"1049bdff10a7538ea6928418d9633d1b2dc593f3","sha512_sri":"sha512-ebK/qtFwiLnSKwhDXl6q175yyM/b9AxK8XCbHqyES2HLl/+NuYcfocFqxAz6pwVVK0Q5bwbkAH97+B0c67lRpg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stripe-internal-utils/v/8.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"b89c3b9d4dee2f11d05bf97a5338eeb6c5b1b2679157feed7984ab3e97d64ddf","import_time":"2026-05-20T15:47:05.552729674Z","modified_time":"2026-05-20T15:00:49Z","versions":["8.2.0"]},{"source":"amazon-inspector","sha256":"b6add7fd3034c5b0d00e39e2cbfeb7c664085ef412612b53ebe9fd81767449be","import_time":"2026-05-26T05:50:53.20860404Z","id":"IN-MAL-2026-003574","modified_time":"2026-05-20T14:47:34Z","versions":["8.2.0"]},{"source":"amazon-inspector","sha256":"d71e5aef7c16dfc093986f47b4607367ff824380452839905a5228ca46f84f63","import_time":"2026-05-26T05:50:53.302365387Z","id":"IN-MAL-2026-003575","modified_time":"2026-05-20T14:47:34Z","versions":["8.2.0"]}]}}