@onum-releases/utils

{"modified":"2026-06-18T17:10:53Z","published":"2026-06-18T16:15:26Z","schema_version":"1.7.4","id":"MAL-2026-6127","summary":"Malicious code in @onum-releases/utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8)\nOn require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com', leaking the installer's hostname via DNS and HTTP to an out-of-band collaborator endpoint controlled by the package publisher. The beacon fires unconditionally on module load, so any consumer that imports the package exposes its host identifier to the attacker-controlled collaborator. The package.json description claims 'Security PoC placeholder - benign, no runtime payload', directly contradicting the shipped code. The scope '@onum-releases' impersonates the Onum vendor namespace, consistent with a dependency-confusion lure aimed at that organization's developers.\n","affected":[{"package":{"ecosystem":"npm","name":"@onum-releases/utils"},"versions":["1.0.1","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"17a8dbe1504773d6f3bbe29b27a7c2cde02b26c2c486887038bcdcba5fa89f85","tlsh":"8ff0dce592b5f4507232a4c8d20e90096293e0802280ced0419ed0e05da1a681702ef8"}],"package_integrity":[{"filename":"utils-1.0.1.tgz","hashes":{"sha1":"97a07d7682334b9d831a20dff1fbe412df8128de","sha512_sri":"sha512-VxYgIbqPKFaRFhZZxN+6vEK8mjmBkMzOfdYavryA4G/LaVVOVMNZ7Agv3KPk+jIX1GlXWHgs8MD4WVddAu373g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/utils/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@onum-releases/utils/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007002","import_time":"2026-06-18T17:08:47.550328116Z","modified_time":"2026-06-18T16:15:27Z","sha256":"057e9534a55fd4068aaffb080224c08a14689dedbeb0737bda03a4c3bbc14a63","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-007001","import_time":"2026-06-18T17:08:47.431910813Z","modified_time":"2026-06-18T16:15:26Z","sha256":"887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8","source":"amazon-inspector","versions":["1.0.2"]}]}}