MAL-2024-1783

Dashboard / Malicious Package / MAL-2024-1783

MAL-2024-1783

Summary: Malicious code in auth0.net (npm)

Details: Source: amazon-inspector (299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1) On `npm install`, package.json's `preinstall` (and `preupdate`/`test`) hook runs `nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun`. The destination `oast.fun` is the Project Discovery interactsh out-of-band callback service used to confirm code execution on victim hosts via a unique DNS subdomain. Firing automatically on install leaks the installer's existence and the corporate DNS resolver's egress IP to an attacker-controlled nameserver, with the unique subdomain serving as a per-victim correlation token. The package itself is hollow — `index.js` is empty, `description` is the placeholder 'Internal package', and `author` is 'Team' — and the package name `auth0.net` impersonates the Auth0 brand, consistent with a dependency-confusion attempt against an internal Auth0/.NET package name. The DNS beacon is the recon stage of that attack: the operator learns which organizations have misconfigured their registry resolution to pull this public package instead of an internal one, enabling targeted follow-on compromise.

References: https://www.npmjs.com/package/auth0.net/v/39.1.0