@remitee-money-transfer/rmt-base

{"modified":"2026-06-26T02:13:30Z","published":"2026-05-21T20:41:29Z","schema_version":"1.7.4","id":"MAL-2026-4424","summary":"Malicious code in @remitee-money-transfer/rmt-base (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16)\nPackage ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the script reads /etc/passwd and /root/.ssh/id_rsa, fetches the host's public IP via ifconfig.me, and POSTs all three values to https://astralishmx.requestcatcher.com/BONK2 using `curl -k` (TLS verification disabled). The package is published under a scope impersonating Remitee (`@remitee-money-transfer/rmt-base`) at an inflated version (99.99.102) consistent with a dependency-confusion attack against a private internal package; the declared `main: index.js` does not exist in the tarball. The author handle (`astralis`) matches the exfiltration hostname, and requestcatcher.com is a free request-capture service commonly abused as a low-effort exfiltration sink. The combined fingerprint — install-time read of classic installer secrets, hardcoded attacker C2, namespace impersonation, dependency-confusion versioning, and absence of any legitimate code — leaves no benign interpretation.\n","affected":[{"package":{"ecosystem":"npm","name":"@remitee-money-transfer/rmt-base"},"versions":["99.99.102","99.99.104","99.99.100","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["ifconfig.me","astralishmx.requestcatcher.com"],"evidence_files":[{"path":"scripts/preinstall.sh","sha256":"8ff8eabefdcda710226d55aeb0a9916c0cc5e6b8ae0ce8e7de288c4b4baf8bdb","tlsh":"aec012d228502c32e6168b54da056528c106d6a31e55de40a279d76c1b8d5955296285"},{"path":"package.json","sha256":"8f02dd72e20e47f131adc4f2a374fd47687842d553b8b4c9361fb467740f70f3","tlsh":"e0d0eb381f12a8336e6083a21e856816a1d086ae5410b83089cb651500a77f01acf206"}],"package_integrity":[{"filename":"rmt-base-99.99.102.tgz","hashes":{"sha1":"5337e95912888379421014261d7b2262d01cf58b","sha512_sri":"sha512-oUBrgwGpxzJgJjNAFjjnwEGoN3vNM0evU6r+bT9Ksf4VxYx+4UKRmV6/QyiAwE/Dyas/omnzvJM331Qb1LUHpQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@remitee-money-transfer/rmt-base/v/99.99.102"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@remitee-money-transfer/rmt-base/v/99.99.100"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@remitee-money-transfer/rmt-base/v/99.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@remitee-money-transfer/rmt-base/v/99.99.104"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004031","import_time":"2026-05-26T05:51:48.387587206Z","modified_time":"2026-05-21T21:03:56Z","sha256":"0cc1b31fb75d4ce14f92cece467379772ae4de69fc124b044fd85fb5532ba28f","source":"amazon-inspector","versions":["99.99.102"]},{"id":"IN-MAL-2026-004242","import_time":"2026-05-26T05:52:13.265948171Z","modified_time":"2026-05-22T18:38:37Z","sha256":"3cbd95509c668d068d92db3ccc5083d85cf00c2c05d96931f89a352d6ab648f7","source":"amazon-inspector","versions":["99.99.104"]},{"id":"IN-MAL-2026-004030","import_time":"2026-05-26T05:51:48.290325974Z","modified_time":"2026-05-21T21:03:55Z","sha256":"5f21c6601855c2f2d0a5d0761d3defe8c0ba1708dd2a67fb278c03e0abd6ba16","source":"amazon-inspector","versions":["99.99.102"]},{"id":"IN-MAL-2026-004027","import_time":"2026-05-26T05:51:47.888056164Z","modified_time":"2026-05-21T20:59:45Z","sha256":"6526c0bb25f024565474beaf77c30272b152a2fe02cf1cece347968d41b5edb5","source":"amazon-inspector","versions":["99.99.100"]},{"id":"IN-MAL-2026-004019","import_time":"2026-05-26T05:51:46.90284456Z","modified_time":"2026-05-21T20:41:29Z","sha256":"906ca2ef612fe4aa96f94925f4a3f1c915867dcf79b5555ad4490477a9c8b5ca","source":"amazon-inspector","versions":["99.99.99"]},{"id":"IN-MAL-2026-004026","import_time":"2026-05-26T05:51:47.687372269Z","modified_time":"2026-05-21T20:59:44Z","sha256":"ed4ebf0f48294e950bcdf6cba604df70c185509480e27bccaed175ef6d8cc0ca","source":"amazon-inspector","versions":["99.99.100"]},{"id":"IN-MAL-2026-004018","import_time":"2026-05-26T05:51:46.810617684Z","modified_time":"2026-05-21T20:41:29Z","sha256":"fc537833cffcbc6cf7ec8f4c13f534faee5194d778be1e7d788dd1f062a793dc","source":"amazon-inspector","versions":["99.99.99"]},{"id":"IN-MAL-2026-004241","import_time":"2026-05-26T05:52:13.155970153Z","modified_time":"2026-05-22T18:38:36Z","sha256":"10364f6cc7a1f72576bc55c4e4e29010e4f4c99a725e685bdefbd91de450953a","source":"amazon-inspector","versions":["99.99.104"]}]}}