blinkit-core

{"modified":"2026-06-23T16:56:04Z","published":"2026-06-21T16:21:08Z","schema_version":"1.7.4","id":"MAL-2026-6249","summary":"Malicious code in blinkit-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8)\nOn `npm install`, the package's `preinstall` lifecycle hook runs `curl` against `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/` and POSTs the installer's hostname (`hostname -f`), current user (`whoami`), working directory, and a base64-encoded dump of the entire process environment (`env | base64 -w0`) — which on CI/build hosts routinely contains tokens, cloud credentials, and registry auth. The package itself is hollow: `index.js` only exports `{ name, version }` and provides no functionality. The `repository.url` claims `git+https://github.com/zomato/blinkit-core.git` while publishing under that internal-sounding name on the public registry, matching the canonical dependency-confusion attacker shape against Zomato's internal `blinkit-core` namespace. Installer harm: any build pipeline that resolves this public package instead of an internal mirror leaks host identity and the full environment (including secrets) to the attacker's out-of-band interaction listener at install time, before any other code runs.\n\n## Source: ossf-package-analysis (304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15)\nThe OpenSSF Package Analysis project identified 'blinkit-core' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"blinkit-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"22c96127b73579bc7e83350f8103221d2b73b0eaa6f58714ae3e2f5a366f1dc9","tlsh":"0201c964793892733d8c4374f936002ab8b16f0f84742c04df9b011c434f715663ea27"}],"package_integrity":[{"filename":"blinkit-core-1.0.0.tgz","hashes":{"sha1":"5b3f91486a814516afcca3e7a8a4f44ae6591183","sha512_sri":"sha512-3OUMGcv04HfBHcYNX4ZckP+B+PiahD/UmgexEwgB3/yH00vPDFhUDyXm2uQxeBKdxwCEUwU27SLWI5rbstnlcQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/blinkit-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"304234c334dce7d26c040f318d608e24b53db9b0b7b0b27d3a6dd2c040481b15","import_time":"2026-06-21T16:38:03.090942785Z","modified_time":"2026-06-21T16:21:08Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8","import_time":"2026-06-23T16:54:12.249149923Z","id":"IN-MAL-2026-007258","modified_time":"2026-06-23T16:00:45Z","versions":["1.0.0"]}]}}