atlasora-client

{"modified":"2026-06-20T13:10:03Z","published":"2026-06-20T13:10:03Z","schema_version":"1.7.4","id":"MAL-2026-6238","summary":"Malicious code in atlasora-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5)\npackage.json declares \"postinstall\": \"node install.js\", which runs automatically on npm install. install.js requires https, fs, os, and child_process; collects host identifiers via os.hostname() and os.userInfo(); invokes execSync() to gather additional system data; checks for sensitive files via fs.existsSync(); and POSTs the collected data over an https.request() to a hardcoded remote endpoint. This is the canonical install-time system-information exfiltration shape: any developer or CI machine that runs `npm install atlasora-client` will silently leak host identity, user account info, and reconnaissance data about local filesystem contents to an attacker-controlled destination.\n","affected":[{"package":{"ecosystem":"npm","name":"atlasora-client"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88","tlsh":"887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff"},{"path":"package.json","sha256":"782c26c852740ff7a2ab03dceb60018bc24307b521ea586bd3f2fca78a7462ba","tlsh":"e4e0e5706e2088735ac9a6ad8da6914676314e0bc4487c1d3ac7205c97de6320afda2d"}],"package_integrity":[{"filename":"atlasora-client-1.0.0.tgz","hashes":{"sha1":"631a9607e1d5033651ecb4f83e881492bbc5e1fe","sha512_sri":"sha512-NnpCy9feNH/GeZ6NhBofP5lwWroCNIN0CMqeu8saHJmYe0EHlvdSmFpXZRAOhpP60oNF6F4TFqq14r3OXYF9JQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/atlasora-client/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007094","import_time":"2026-06-20T13:37:51.004020105Z","modified_time":"2026-06-20T13:10:03Z","sha256":"fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5","source":"amazon-inspector","versions":["1.0.0"]}]}}