@onum-releases/auth

{"modified":"2026-06-18T17:10:53Z","published":"2026-06-18T16:15:16Z","schema_version":"1.7.4","id":"MAL-2026-6123","summary":"Malicious code in @onum-releases/auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (22d4bde1772d506f812e112fb8d6bfbf6a6f187dd823640f2cf15811f0d0633a)\nOn `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com`, transmitting the installer's host identifier to a Burp Collaborator out-of-band domain via both DNS resolution and HTTP. The package.json self-identifies as a 'dependency-confusion / scope-takeover demonstration' placeholder under the @onum-releases scope, so any build that mistakenly resolves an internal `@onum-releases/*` name to the public registry will leak its hostname to a third-party collaborator endpoint. Although labeled a PoC, the import-time beacon performs unconsented exfiltration of installer-side data to an attacker-controlled domain.\n","affected":[{"package":{"ecosystem":"npm","name":"@onum-releases/auth"},"versions":["1.0.3","1.0.1","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4367e2a734dcc5e7dce75530a942ff5ed14d13c12d1cef9e2838bb412d2852bd","tlsh":"18f0abdad3f9f5507132a4c9e60e4404a2a2f0902286dec055afe1f62df2b181b06df8"},{"path":"package.json","sha256":"bf819df9feebf5605afe822bc64fb26c3169c55eca3137503cc238893812c081","tlsh":"46d02b644644a43354c5cb760d70952922b95c3fb24271092f179218c0abbf31579389"}],"package_integrity":[{"filename":"auth-1.0.3.tgz","hashes":{"sha1":"d9db879454e53c8c137e2f3c9281ff229225074b","sha512_sri":"sha512-yMJq5M6LxNBMaCLtphbawGK84164sj8psWAXLMiX/YeVR/qh8EFzKe6iYG81DCE17mZ5yTjD3QkY1Kp3qLfb0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/auth/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/auth/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/auth/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006989","import_time":"2026-06-18T17:08:46.473870933Z","modified_time":"2026-06-18T16:15:16Z","sha256":"22d4bde1772d506f812e112fb8d6bfbf6a6f187dd823640f2cf15811f0d0633a","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-006991","import_time":"2026-06-18T17:08:46.646372864Z","modified_time":"2026-06-18T16:15:18Z","sha256":"72203eaa09216d9c9eb3cb0202eba28ce4e44f14ee587608ddd8b0b62829dae6","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-006990","import_time":"2026-06-18T17:08:46.563481749Z","modified_time":"2026-06-18T16:15:17Z","sha256":"75e6ff09332290e46dd6b6b660cdf20f335d18eddc93060373b5211ebab6f524","source":"amazon-inspector","versions":["1.0.2"]}]}}