payment-account-input-selector

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-21T10:54:34Z","schema_version":"1.7.4","id":"MAL-2026-4635","summary":"Malicious code in payment-account-input-selector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (12187e6fb4ae4d3a411cea0c3ec8b995e1091a9cf78219db9fbcdac87540aabf)\nOn `npm install`, preinstall.js collects hostname, username, platform, cwd, timestamp, and a full dump of os.networkInterfaces() and HTTP-GETs them as query parameters to a hardcoded Burp Collaborator (oastify.com) endpoint. Errors are silently swallowed (the source comment notes 'Silent fail to avoid detection'). The package's metadata advertises an Oracle JET payment account selector but ships only a 5-line stub for index.js — the only real logic is the install-time beacon. The combination of empty author metadata, generic 'oracle/jet/payment' keywords, hollow main entry, and a recon-only preinstall is consistent with a dependency-confusion probe against an internal Oracle JET package name, with installer host/network topology exfiltrated to the attacker's OAST collector.\n","affected":[{"package":{"ecosystem":"npm","name":"payment-account-input-selector"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["hxip7klpzbucongciitep20es5ywmvak.oastify.com"],"evidence_files":[{"path":"preinstall.js","sha256":"7812bf4d47dbc9ed9d444cc159bbcb088247f1d7cd9ba349b7306a690b7b2963","tlsh":"ce0112b054b6a2e02df117c050a11636f1ffe214bd1171977cfa03c847198318711a77"},{"path":"package.json","sha256":"dcbf8282460431a407d04522885b2b127fc4343b5b7a396d80dc5948832ac36a","tlsh":"1ad02b342820a83328c68ab12d63e14eb3a28d5b40003c0ca3c3001406de97386bb55f"}],"package_integrity":[{"filename":"payment-account-input-selector-1.0.0.tgz","hashes":{"sha1":"485ed9e4b60f1fc9656c70d93c89dc42549fab7c","sha512_sri":"sha512-axOPILYT5JNVjcSulT+Z1jUZ1uWh3WSm1ud3Nlz6i5FOMRrf3OLto5Ltw4sLEKnym4Ru2g8QdqEEprDIJEECbA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/payment-account-input-selector/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003800","import_time":"2026-05-26T05:51:20.359843654Z","modified_time":"2026-05-21T10:54:34Z","sha256":"12187e6fb4ae4d3a411cea0c3ec8b995e1091a9cf78219db9fbcdac87540aabf","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-003801","import_time":"2026-05-26T05:51:20.465695223Z","modified_time":"2026-05-21T10:54:34Z","sha256":"7b74f6fab946732374a26dc312d5c41e59e54ec1391b4360f7acb918644d109d","source":"amazon-inspector","versions":["1.0.0"]}]}}