cloudsmith-vsc

{"modified":"2026-05-26T05:55:02Z","published":"2026-05-21T20:18:50Z","schema_version":"1.7.4","id":"MAL-2026-4530","summary":"Malicious code in cloudsmith-vsc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b49ad4432747f754181e7a8428aff5fd2613f9d86283f05a04c2dd1f9ac2f2f)\npackage.json declares a preinstall hook (`\"preinstall\": \"node index.js\"`) that runs automatically on `npm install`. index.js reads installer-side system identity and files — `os.hostname()`, `os.userInfo()`, homedir, DNS configuration, package metadata, `/etc/passwd`, and `/etc/hosts` — and POSTs them over HTTPS to a hardcoded Burp Collaborator subdomain (`6hoa7n94q5v6yig1hqokwg6f066zupie.oastify.com`). The package metadata is empty (no description, author, or license) and the name impersonates the Cloudsmith vendor brand, consistent with a dependency-confusion / typosquat recon-and-exfil payload. Any machine that installs this package transmits host fingerprinting and local account data to the attacker.\n","affected":[{"package":{"ecosystem":"npm","name":"cloudsmith-vsc"},"versions":["2.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["6hoa7n94q5v6yig1hqokwg6f066zupie.oastify.com"],"evidence_files":[{"path":"index.js","sha256":"90a1bfca0b7c5f70251dcb2a80f5be735ee867b0423d74de994de7dc6c895a30","tlsh":"36412395a2c917330de250c06a0c70842359fa777169e8d076cf42d6af869f8bb726f3"},{"path":"package.json","sha256":"6cb0e7edb6061c94dd2db1047811b2963f309cc734912b4a315588eaffb58b49","tlsh":"00d05e244e21663365c502a60c2b944a62a18f2b05043c08638b182c919e677a8fb31d"}],"package_integrity":[{"filename":"cloudsmith-vsc-2.1.2.tgz","hashes":{"sha1":"183b643957e6888802a34a88a046be57cf31e36d","sha512_sri":"sha512-Z/tEK9ouOUj4aZJWBdhQNKMetFQbhDHRZYKNEv+W7g7SONLNZhiCeOxBvIUsv9yY5gZv8QKCo0FpV4p8+QlVTw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cloudsmith-vsc/v/2.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004014","import_time":"2026-05-26T05:51:46.301697711Z","modified_time":"2026-05-21T20:18:50Z","sha256":"2b49ad4432747f754181e7a8428aff5fd2613f9d86283f05a04c2dd1f9ac2f2f","source":"amazon-inspector","versions":["2.1.2"]},{"id":"IN-MAL-2026-004015","import_time":"2026-05-26T05:51:46.418503203Z","modified_time":"2026-05-21T20:18:50Z","sha256":"b426dccab89457fd791a8fd83473fe7afa862d2e532c41b1fd635bb251e5c830","source":"amazon-inspector","versions":["2.1.2"]}]}}