yunxin-overmind-comment

{"modified":"2026-06-15T20:11:26Z","published":"2026-06-15T20:11:26Z","schema_version":"1.7.4","id":"MAL-2026-5833","summary":"Malicious code in yunxin-overmind-comment (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc)\nOn `npm install`, the package's `scripts.postinstall` runs `src/_postinstall.js`, which spawns a detached Node child that collects the installer's hostname, username, platform/arch, cwd, Node version, npm registry, all non-internal IPv4 addresses, and the keys of environment variables matching /NPM|NODE|CI|JENKINS|GIT|BUILD|RUNNER|DOCKER|KUBE|REGISTRY/. The collected data is HTTPS-POSTed to a hardcoded DingTalk bot webhook (`https://oapi.dingtalk.com/robot/send?access_token=4e5cb67f...df393`). Before sending, the script checks the username and hostname against an analyst/sandbox keyword list (`sandbox`, `malware`, `analyst`, `cuckoo`, `analysis`, `sample`) and silently no-ops if any match — explicit anti-analysis evasion. The combination of automatic install-time execution, host/network reconnaissance scoped to CI/build runners, hardcoded attacker-controlled callback, and sandbox-evasion gating is the canonical dependency-confusion beacon shape. Installing this package leaks internal hostnames, IP topology, and CI/build environment fingerprints to the operator of the DingTalk webhook, enabling targeted follow-on attacks against the installer's internal infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"yunxin-overmind-comment"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/_postinstall.js","sha256":"d74886e20adaab3cbdb25d8f54ed4ed3a7f22c1d48e0e7ad80a740be9a238a1b","tlsh":"da41b5e675a57638177c85c290821016da67e2223583f8e0fc2c41d61bc7cfa9af193e"}],"package_integrity":[{"filename":"yunxin-overmind-comment-1.2.0.tgz","hashes":{"sha1":"3b76dd6b1b7ee4100b68bd16e51331383cd85765","sha512_sri":"sha512-K6rMksJ/7gEdo+1pn238nUYBxfFvStI+Q+P6Z0DKlz79wi3obd2o5ZOY4lPfE8owEvse++PoEJYGh3faQkvvCA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/yunxin-overmind-comment/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006704","import_time":"2026-06-15T20:14:29.574321648Z","modified_time":"2026-06-15T20:11:26Z","sha256":"57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc","source":"amazon-inspector","versions":["1.2.0"]}]}}