MAL-2026-12491
Dashboard / Malicious Package / MAL-2026-12491
MAL-2026-12491
Summary: Malicious code in uploader-frontend (npm)
Details: Source: amazon-inspector (434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911) The package's `scripts.install` runs `node index.js`, which loads `./lib/core` and, on `npm install`, collects the installer's OS username (via `os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, encodes them as a subdomain, and issues a `dns.resolve4` lookup against the hardcoded attacker domain `oob.sl4x0.xyz` — a DNS out-of-band beacon that exfiltrates installer identity. The `require` targets (`dns`, `os`, `process`), the API names (`userInfo`, `username`, `hostname`, `cwd`, `resolve4`), and the destination domain are reconstructed at runtime from `String.fromCharCode` numeric arrays to hide the destination and the APIs used. Package name and README advertise `uploader-frontend` / enterprise utilities and validation, but the auto-executed code implements no such functionality — only the beacon. The `author` email `[email protected]` shares the domain of the exfil host, and `homepage` points at an unrelated project (`github.com/slaxorg/nms-dashboard-js`), indicating publisher-controlled attacker infrastructure.
Affected packages
Package
Name: uploader-frontend
Purl: pkg:npm/uploader-frontend
Affected ranges
Type: N/A
Events:
