MAL-2026-11996

    Dashboard / Malicious Package / MAL-2026-11996

    MAL-2026-11996

    Published: 4 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in emulative (npm)

    Details: Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca) On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.

    References: https://www.npmjs.com/package/emulative/v/1.0.1

    Affected packages

    Package

    Name: emulative

    Purl: pkg:npm/emulative

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-11996 | CVE-DB