MAL-2026-10086

    Dashboard / Malicious Package / MAL-2026-10086

    MAL-2026-10086

    Published: 9 Jul 2026Last Modified: 9 Jul 2026

    Summary: Malicious code in dl-pp-latm (npm)

    Details: Source: amazon-inspector (e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716) Package [email protected] registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers — os.hostname(), os.userInfo().username, os.homedir(), dns.getServers(), current working directory, and the full package.json — and transmits them via HTTPS POST and DNS lookup to an Interactsh-style subdomain 'bvfmpadujgjgmbtzeibiikzijuhmtd2rs.oast.fun'. The package name pattern and 'Internal App bUg b0UntY gollum22' description match a dependency-confusion probe targeting internal/private package names; any developer workstation or CI system that resolves this package leaks internal hostnames, usernames, and DNS configuration to a third-party OOB collector. This fires automatically on npm install without user interaction.

    References: https://www.npmjs.com/package/dl-pp-latm/v/80.4.2

    Affected packages

    Package

    Name: dl-pp-latm

    Purl: pkg:npm/dl-pp-latm

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    80.4.2
    MAL-2026-10086 | CVE-DB