MAL-2026-12360

    Dashboard / Malicious Package / MAL-2026-12360

    MAL-2026-12360

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in csv-parser-helper (npm)

    Details: Source: amazon-inspector (90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca) The package is advertised as a CSV parser but ships a postinstall.js that runs on `npm install` and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working directory, `uname -a`, container indicators, process tree, and network information; probes AWS and Tencent instance metadata services at 169.254.169.254 and metadata.tencentyun.com; and dumps the full process environment while filtering out only npm noise (retaining any token/secret-shaped variables such as GITHUB_TOKEN, cloud provider keys, and CI credentials). The collected data is base64-encoded and exfiltrated via HTTP GET query string to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package's stated CSV-parsing purpose is a cover story — index.js is unrelated code and no CSV functionality is present.

    References: https://www.npmjs.com/package/csv-parser-helper/v/1.0.0

    Affected packages

    Package

    Name: csv-parser-helper

    Purl: pkg:npm/csv-parser-helper

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12360 | CVE-DB