MAL-2026-10203

    Dashboard / Malicious Package / MAL-2026-10203

    MAL-2026-10203

    Published: 12 Jul 2026Last Modified: 12 Jul 2026

    Summary: Malicious code in giantswarm (npm)

    Details: Source: amazon-inspector (75f3a244f2761c56347f695897a491d23ab04cafe1e5b0e46fd7d0d2c993f828) The package declares a `preinstall` hook (`node index.js`) that runs automatically on `npm install`. index.js collects host reconnaissance — hostname, platform, arch, home directory, username/uid/gid/shell, `whoami`, `id`, and cwd — and POSTs the collected data as JSON to a hardcoded Burp Collaborator subdomain at https://w305i20ui5s5476lc3b998z28tek2bq0.oastify.com/detox56. The package ships with empty description, author, and license fields and no functional code beyond the beacon. The unscoped name `giantswarm` impersonates the Giant Swarm vendor namespace, consistent with a dependency-confusion attack targeting private `@giantswarm/*` scopes.

    References: https://www.npmjs.com/package/giantswarm/v/22.0.1

    Affected packages

    Package

    Name: giantswarm

    Purl: pkg:npm/giantswarm

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.0.1