@koadz/sso

{"modified":"2026-06-11T04:45:50Z","published":"2026-06-11T04:45:50Z","schema_version":"1.7.4","id":"MAL-2026-5562","summary":"Malicious code in @koadz/sso (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d284d5d0421ad906d63959ed4e0f3354106166311f4066ff794669f52d1eacfb)\npackage.json declares a postinstall hook that runs dist/index.js. The compiled bundle contains an appended payload (absent from the index.ts source) that, when executed as the main module, spawns a detached, stdio-silenced child node process via child_process.spawn(process.execPath, ['-e',...]). The inline script collects os.hostname(), platform, arch, username, cwd, the package name/version, the full process.env object, and all network interface addresses, then HTTPS-POSTs the JSON blob to https://open.feishu.cn/open-apis/bot/v2/hook/94ad3a53-f0d6-4ddd-809f-305d928db6d5. The hook fires automatically on every `npm install`, harvesting CI/CD secrets (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database credentials, etc.) from any machine that installs the package. The detached/unref'd spawn and stdio:'ignore' hide the activity from install logs, and the source/dist divergence indicates a deliberate payload smuggle rather than documented behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"@koadz/sso"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"dbb263689651ef8c405b10df1fbf8c0c3a4d5828fe6556b673da304b718f6ac8","tlsh":"df319a9337d9fde493e402d44a27a4915fe9d0323021b4f8e38c5ef907952858191b6e"}],"package_integrity":[{"filename":"sso-1.0.0.tgz","hashes":{"sha1":"8118f653cc1407ed91422e8261d24a34ec1f9f29","sha512_sri":"sha512-8wT3rW67HtGWIdXSJSdkbXhxhwKxCk2If6bzvigqqhEQQx6fhLis/ZvTArFb+oOe/JSGXjhzLceB/L3Mxg841A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@koadz/sso/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005470","import_time":"2026-06-11T05:40:58.100000573Z","modified_time":"2026-06-11T04:45:50Z","sha256":"d284d5d0421ad906d63959ed4e0f3354106166311f4066ff794669f52d1eacfb","source":"amazon-inspector","versions":["1.0.0"]}]}}