easy-string-kit

{"modified":"2026-06-25T16:25:25Z","published":"2026-06-25T08:39:07Z","schema_version":"1.7.4","id":"MAL-2026-6459","summary":"Malicious code in easy-string-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8cb77d96cfd133340395df1765df2426f8414d80158e62ee5832ab6d4a18e803)\npackage.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl POST requests harvesting cloud-instance identity and credential data from /data/* paths (ami-id, instance-id, iam/, identity-credentials/, public-keys/, security-groups, mac, hostname, local/public ipv4, etc.). Each value is sent over plain HTTP to http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/, a Burp Suite Collaborator out-of-band exfiltration host controlled by the attacker. The package advertises itself as 'a collection of handy string utility functions' but ships no string-utility code coupled to the install hook — only the exfiltration payload. Author, repository, bugs, and homepage fields are all empty strings, consistent with a disposable namespace-squat used to deliver an exfiltration payload (dependency-confusion / typosquat shape). Installing this package on any host — and especially on a cloud build agent — leaks IAM metadata, SSH public keys, and instance identity to an attacker-controlled collaborator endpoint.\n\n## Source: ossf-package-analysis (afb272eb6208527c57abc9ef604a3776dfdca057e5c9b16e524aa4703df623b4)\nThe OpenSSF Package Analysis project identified 'easy-string-kit' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"easy-string-kit"},"versions":["1.0.1","1.0.4","1.0.5","1.0.8","1.0.6","1.0.7","1.0.3","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"9d72c49c5130c93317fac6d857404086682bcc513b5b5457e0ba917f6d55973c","tlsh":"b301cb14c2205d3316d96a30b99b0643b0125e5b09143c1877c3812c0fbf76b90fe26d"}],"package_integrity":[{"filename":"easy-string-kit-1.0.7.tgz","hashes":{"sha1":"590bd3e82b79a98f84c355e7bbebde0b97d722a2","sha512_sri":"sha512-cNRekItuFgRPtDdwb3nJPO7A/vnJtq6yl/dTprmQNHGvQDGhACo0KPuYpVDYqdKuEPlwU4FJ6+cSjZd0XLluOQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"afb272eb6208527c57abc9ef604a3776dfdca057e5c9b16e524aa4703df623b4","import_time":"2026-06-25T09:12:42.856065352Z","modified_time":"2026-06-25T08:39:07Z","versions":["1.0.1"]},{"source":"ossf-package-analysis","sha256":"c55d7da68cef70d2fe31e80813b424d9dffc89df94655a004ad5b75164bd31ce","import_time":"2026-06-25T09:12:42.979333164Z","modified_time":"2026-06-25T09:06:09Z","versions":["1.0.4"]},{"source":"ossf-package-analysis","sha256":"f74efd21d4c8aa6f6f7ca656d1e95ce1ed8af540bec178c8dba68d18c100b58e","import_time":"2026-06-25T09:12:43.095282184Z","modified_time":"2026-06-25T09:10:57Z","versions":["1.0.5"]},{"source":"ossf-package-analysis","sha256":"782d491f535725c6f1d9094004d37fa1b859b51029af438489c43337ca6100c8","import_time":"2026-06-25T10:28:39.629224177Z","modified_time":"2026-06-25T09:45:51Z","versions":["1.0.8"]},{"source":"ossf-package-analysis","sha256":"b125035c3620d0661cf2f91de0406674fbfa03d2dbd9604bc4be06b2bf91da00","import_time":"2026-06-25T10:28:39.535440527Z","modified_time":"2026-06-25T09:15:47Z","versions":["1.0.6"]},{"source":"amazon-inspector","sha256":"4c8bf2d258e00356212c31be69265d92f7dce0d1d44d722b06fe44af794c3c05","import_time":"2026-06-25T16:23:40.522701525Z","id":"IN-MAL-2026-007521","modified_time":"2026-06-25T16:10:36Z","versions":["1.0.7"]},{"source":"amazon-inspector","sha256":"8cb77d96cfd133340395df1765df2426f8414d80158e62ee5832ab6d4a18e803","import_time":"2026-06-25T16:23:40.111114444Z","id":"IN-MAL-2026-007515","modified_time":"2026-06-25T16:10:29Z","versions":["1.0.5"]},{"source":"amazon-inspector","sha256":"996cfedfd2d4f07a054c81e53a6600f942c7191d1741cfbedc0ab5b3eeba80a2","import_time":"2026-06-25T16:23:40.064106976Z","id":"IN-MAL-2026-007514","modified_time":"2026-06-25T16:10:28Z","versions":["1.0.8"]},{"source":"amazon-inspector","sha256":"ac1d07cf8a31b279f0813624af49d302d733976816c312ddc5b5ae450e33f3fd","import_time":"2026-06-25T16:23:40.335163234Z","id":"IN-MAL-2026-007518","modified_time":"2026-06-25T16:10:33Z","versions":["1.0.3"]},{"source":"amazon-inspector","sha256":"b239d7d57b3db762c896e61f2ab9c2307258df820bf235c1580e0a4201e57cb5","import_time":"2026-06-25T16:23:40.203919421Z","id":"IN-MAL-2026-007517","modified_time":"2026-06-25T16:10:32Z","versions":["1.0.4"]},{"source":"amazon-inspector","sha256":"e0c51a3080a31d94680aa3ff7e8804fbc4eb3860b2b60e7e3d0efa2fc8bd1ebc","import_time":"2026-06-25T16:23:40.398770274Z","id":"IN-MAL-2026-007519","modified_time":"2026-06-25T16:10:33Z","versions":["1.0.2"]},{"source":"amazon-inspector","sha256":"0fbb31b7d499411ca75ce301e70f9fd70e92b962fed95967fadc2d21e434e0dc","import_time":"2026-06-25T16:23:40.006717888Z","id":"IN-MAL-2026-007513","modified_time":"2026-06-25T16:10:26Z","versions":["1.0.6"]},{"source":"amazon-inspector","sha256":"31e6843fcf9481d9bb7e803995a1710b8d325a7661a8cd8fff5ba6f4be6737a5","import_time":"2026-06-25T16:23:40.4745967Z","id":"IN-MAL-2026-007520","modified_time":"2026-06-25T16:10:35Z","versions":["1.0.1"]}]}}