clickpy

{"modified":"2026-05-26T05:55:02Z","published":"2026-05-22T20:12:32Z","schema_version":"1.7.4","id":"MAL-2026-4270","summary":"Malicious code in clickpy (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dd3b0787797fa520a5583fd5f14b83ec1b4606c0c45051e30ef312869c148f01)\nOn `require('clickpy')`, index.js collects host metadata via `os.hostname()`, `os.userInfo()`, `os.platform()`, `os.arch()`, `process.cwd()`, `process.pid`, and the current time, then issues an HTTPS GET to the hardcoded out-of-band host `fxpkkxatijbbyxuhdclqssj033zarohm1.oast.fun` with these values as query-string parameters (index.js:4 and index.js:25-29). oast.fun is the interactsh/OAST collaborator service used to receive callbacks from victim hosts; there is no legitimate purpose for a published library to beacon installer identifiers to such a host on import. Package metadata is empty (no description, no author), consistent with a throwaway recon/PoC exfiltration package.\n\n## Source: ossf-package-analysis (4eabe2c137602d61ffca6cc787c74601220c1e92f9b77300775a94327b784600)\nThe OpenSSF Package Analysis project identified 'clickpy' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"npm","name":"clickpy"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["fxpkkxatijbbyxuhdclqssj033zarohm1.oast.fun"],"evidence_files":[{"path":"index.js","sha256":"d033908652168f2b1a8262d3eb023a5810962756ec051c21c2c0130f0eb36a85","tlsh":"9d1112f159f28aa01dbb31c459c75c09a0aed1137e09f8fc7e8d43e00f854a545b1bb4"}],"package_integrity":[{"filename":"clickpy-1.0.1.tgz","hashes":{"sha1":"58dc914aec4ce268b5deb5a05a1bf6175f3918ce","sha512_sri":"sha512-W25FZtJ4oIvxG11J6RLSqdHAV0peu3tDVW079dIzHe6URDl3rrqKUdOBD8BgByzuMt3+9Hr8pWhCSvceB2ZnYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/clickpy/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/clickpy/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"4eabe2c137602d61ffca6cc787c74601220c1e92f9b77300775a94327b784600","import_time":"2026-05-23T23:23:03.728296797Z","modified_time":"2026-05-23T23:00:29Z","versions":["1.0.1"]},{"source":"amazon-inspector","sha256":"dd3b0787797fa520a5583fd5f14b83ec1b4606c0c45051e30ef312869c148f01","import_time":"2026-05-26T05:52:29.851314751Z","id":"IN-MAL-2026-004386","modified_time":"2026-05-23T22:16:20Z","versions":["1.0.1"]},{"source":"amazon-inspector","sha256":"41e40fb2fc334582046d0e03983f4099343239a00886333fe924d5b6f093f4fe","import_time":"2026-05-26T05:52:14.509455242Z","id":"IN-MAL-2026-004253","modified_time":"2026-05-22T20:12:32Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"6168bc8825a452e85328ec4a78bc82916c4a1dd1030593778093c576c6cc8d98","import_time":"2026-05-26T05:52:30.203270755Z","id":"IN-MAL-2026-004389","modified_time":"2026-05-23T22:20:24Z","versions":["1.0.1"]}]}}