atlasora-config

{"modified":"2026-06-20T13:10:08Z","published":"2026-06-20T13:10:08Z","schema_version":"1.7.4","id":"MAL-2026-6239","summary":"Malicious code in atlasora-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f33093da9f0bcf9358f3b00bd87e723d95267074539c72511ab58bff4172f092)\nThe package declares a postinstall hook in package.json (\"postinstall\": \"node install.js\") that auto-executes install.js on every npm install. install.js imports https, fs, os, and child_process; collects host identity via os.hostname() and os.userInfo() (line 16, 18); reads filesystem state with fs.existsSync (lines 53, 62, 83); shells out via execSync (line 77); and POSTs the collected data over an https.request to a remote endpoint (lines 96, 104, 113). The combination of host/user identity collection, filesystem probing, command execution, and outbound HTTPS POST inside a postinstall script is the canonical install-time exfiltration shape. Installing the package causes the installer's machine identity and environment data to be transmitted to a remote endpoint without consent.\n","affected":[{"package":{"ecosystem":"npm","name":"atlasora-config"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88","tlsh":"887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff"},{"path":"package.json","sha256":"45d3280c7ac0a0eb1c04adee2481176cf99f5baf78299a5d50fec2da2629aa05","tlsh":"bfe02b306a20cc335ad466694d62500679314f4bc4486c1d37d73028978e77609bea1d"}],"package_integrity":[{"filename":"atlasora-config-1.0.0.tgz","hashes":{"sha1":"6b8f98a8959ab2947fa6188999f9d2b7c17b897a","sha512_sri":"sha512-ErMNtFOTG1lWfJv2GmoMcPABREmovtWRERUTchHb/GK8VZc45f4xTJlmvVupKCLtMtO8leRi6lkLJuSye8JEfQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/atlasora-config/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007100","import_time":"2026-06-20T13:37:51.60885376Z","modified_time":"2026-06-20T13:10:08Z","sha256":"f33093da9f0bcf9358f3b00bd87e723d95267074539c72511ab58bff4172f092","source":"amazon-inspector","versions":["1.0.0"]}]}}