delta-time-32bb

{"modified":"2026-06-23T22:26:24Z","published":"2026-06-23T22:26:24Z","schema_version":"1.7.4","id":"MAL-2026-6351","summary":"Malicious code in delta-time-32bb (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bcbd5b3b8f7702c8cf59c094e98f078f68563d407235bce1dd0ec6e6522fe03b)\nPackage declares a postinstall hook (\"postinstall\": \"node run.js\" in package.json) that executes run.js automatically on npm install. run.js imports os, fs, http, https, and child_process and collects host identifiers and environment data — os.hostname(), os.userInfo(), os.platform(), process.env.USER, process.cwd() — base64-encodes the payload via Buffer.from(...).toString('base64'), and POSTs over http/https. The package has no documented purpose justifying install-time host reconnaissance and outbound network. The shape (lifecycle-triggered collection of host identity + environment + base64 wrapping + HTTP POST) is a credential/host-recon exfiltration beacon executed without user interaction on default install.\n","affected":[{"package":{"ecosystem":"npm","name":"delta-time-32bb"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"2e37bc22c0691ce0d97a93a6d958b08415c326fef3cd2978c399795c838f80c3","tlsh":"cbe06818dc20393339d02ea90c629297b7308f1b20143d2da3b7282842abb3a747b20d"},{"path":"run.js","sha256":"12c08dbb2041442756015306e4864d161f20a14796245f761d5089b4ce3074e5","tlsh":"bf82f77219b7461479a3eaade66fa4005033f1177a41eda0f28c73510fcf668d572af8"}],"package_integrity":[{"filename":"delta-time-32bb-1.0.0.tgz","hashes":{"sha1":"42f301b54f1e3159634c739af31a03c4b306d788","sha512_sri":"sha512-tJzKJfH8IiSjLkUpz/I32qImfZVe+EAI1osTZQWyrW4q/r6vyKRuXx3UueykMxex5Gv8E7TXnmc1CJCeIzbAZg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/delta-time-32bb/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007391","import_time":"2026-06-23T22:31:28.820392051Z","modified_time":"2026-06-23T22:26:24Z","sha256":"bcbd5b3b8f7702c8cf59c094e98f078f68563d407235bce1dd0ec6e6522fe03b","source":"amazon-inspector","versions":["1.0.0"]}]}}