osep-api-hub-service-client-v1

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-22T13:52:26Z","schema_version":"1.7.4","id":"MAL-2026-4633","summary":"Malicious code in osep-api-hub-service-client-v1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cd131719d20e013a4627e1ea402ffc26135d66a5d6dd35669b8a3a6fb85e5f76)\npackage.json declares `\"preinstall\": \"node index.js\"`, causing index.js to run automatically on `npm install`. index.js collects host identifiers — `os.hostname()`, `os.userInfo()` (username/uid/gid/shell), `os.homedir()`, `process.platform`, `process.arch`, `process.cwd()` — and additionally shells out via `child_process` to `whoami` and `id`. The collected JSON is POSTed to the hardcoded URL `https://0pqbxi1hplohnif3fa7tyc1at1zsnobd.oastify.com/detox56`, a Burp Collaborator (oastify.com) subdomain controlled by whoever published the package. The package name mimics an internal-sounding scoped client and ships with empty author/description metadata, consistent with a dependency-confusion attack targeting a private package namespace. Any developer or CI system that installs this package immediately leaks host and user identity to the attacker's Collaborator endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"osep-api-hub-service-client-v1"},"versions":["10.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["0pqbxi1hplohnif3fa7tyc1at1zsnobd.oastify.com"],"evidence_files":[{"path":"index.js","sha256":"358592649438ef0e2e1176d3cafbc822adf727f6fffdea54524afd613e4ed9e3","tlsh":"5c5152c515f65a241ba7b8494a4f9002a327e0033545ee55bfcc8340af8837c97f0bf2"},{"path":"package.json","sha256":"fa9fd8adb20800478e419d98ed82b897834b64ef4937a406cef58b9475710292","tlsh":"c1d05e648e62553329c506a24c2ba456b2729f2f54157c08a3df582c41ceb7798fe31c"}],"package_integrity":[{"filename":"osep-api-hub-service-client-v1-10.9.1.tgz","hashes":{"sha1":"f0380d53674f87e066935543c56fded022942ac5","sha512_sri":"sha512-YL3O0dgCurCqZ6c40W9LAyq+tIgl2XJRwRbbLtgfTowcuPE6A8xlLXpZSAgji+92PQnAmabSYUARQtZCFDk8kA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/osep-api-hub-service-client-v1/v/10.9.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004210","import_time":"2026-05-26T05:52:09.597331913Z","modified_time":"2026-05-22T13:52:26Z","sha256":"35b827956cab8e1ef741b2291e076175d7e61e4c19cff7faaf4ff94cf6792620","source":"amazon-inspector","versions":["10.9.1"]},{"id":"IN-MAL-2026-004209","import_time":"2026-05-26T05:52:09.498565128Z","modified_time":"2026-05-22T13:52:26Z","sha256":"cd131719d20e013a4627e1ea402ffc26135d66a5d6dd35669b8a3a6fb85e5f76","source":"amazon-inspector","versions":["10.9.1"]}]}}