MAL-2026-12492

    Dashboard / Malicious Package / MAL-2026-12492

    MAL-2026-12492

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in uploader-frontend-legacy (npm)

    Details: Source: amazon-inspector (0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681) The package's `scripts.install` runs `node index.js`, which loads `lib/core.js` and issues a `dns.resolve4` query against a subdomain of `oob.sl4x0.xyz` constructed from `os.userInfo().username`, `os.hostname()`, and `process.cwd()`, along with a package tag and timestamp. Module names (`os`, `dns`, `process`), API names (`userInfo`, `hostname`, `cwd`, `resolve4`), and the destination domain `oob.sl4x0.xyz` are assembled from `String.fromCharCode` byte arrays in `lib/b02e30.js`, `lib/6ad264.js`, and `lib/core.js` to hide the behavior from casual review. The net effect on `npm install` is an outbound DNS beacon carrying installer-identifying data to an author-controlled out-of-band listener.

    References: https://www.npmjs.com/package/uploader-frontend-legacy/v/9.9.11

    Affected packages

    Package

    Name: uploader-frontend-legacy

    Purl: pkg:npm/uploader-frontend-legacy

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.9.11
    MAL-2026-12492 | CVE-DB