MAL-2026-10579

    Dashboard / Malicious Package / MAL-2026-10579

    MAL-2026-10579

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in bimi-maker (npm)

    Details: Source: amazon-inspector (4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f) On `npm install`, the package's preinstall hook runs `node index.js`, which executes `whoami` and `id` via child_process and collects `os.hostname()`, `os.userInfo()`, `os.platform()`, homedir, cwd, and related host identifiers. The collected JSON payload is POSTed over HTTPS to a hardcoded Burp Collaborator subdomain, `https://mqgby2y4jlp0k06gbpg1ulgjqaw1ks8h.oastify.com/detox56`. The package ships no legitimate functionality matching its BIMI-related name; the only observable behavior is an install-time reconnaissance beacon to an attacker-controlled OAST endpoint, consistent with dependency-confusion or typosquat probing.

    References: https://www.npmjs.com/package/bimi-maker/v/8.2.4

    Affected packages

    Package

    Name: bimi-maker

    Purl: pkg:npm/bimi-maker

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    8.2.4
    MAL-2026-10579 | CVE-DB