MAL-2026-10609

    Dashboard / Malicious Package / MAL-2026-10609

    MAL-2026-10609

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in utils-style-engine (npm)

    Details: Source: amazon-inspector (3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52) The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers (os.hostname(), os.userInfo(), uid/gid, shell, homedir, process.platform, cwd, and the output of `whoami`/`id` via child_process) and POSTs the collected data as JSON to a hardcoded external endpoint at https://mj9yg25wm8m4vnkrrok8lwcogfm6awyl.oastify.com/detox56 (a Burp Suite Collaborator subdomain). The package ships no other functionality: package.json has an empty description, empty author, no repository, and the generic name `utils-style-engine`; the only shipped file besides the manifest is the beacon script. The shape is consistent with a dependency-confusion / reconnaissance probe.

    References: https://www.npmjs.com/package/utils-style-engine/v/10.2.4

    Affected packages

    Package

    Name: utils-style-engine

    Purl: pkg:npm/utils-style-engine

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.2.4
    MAL-2026-10609 | CVE-DB