MAL-2026-12506

    Dashboard / Malicious Package / MAL-2026-12506

    MAL-2026-12506

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @latlongid/location (npm)

    Details: Source: amazon-inspector (134cf39570bebc6b10043353b9194b41e30da9b0f55147501ccc060bb32c7e8e) @latlongid/[email protected] declares `postinstall: node index.js` in package.json, so `index.js` runs automatically on every `npm install`. That script hex-encodes the installer's `os.hostname()` and embeds it as a subdomain of `dns.gl0b.xyz`, then invokes `dns.lookup` on the constructed name (e.g. `2d5bccee-...-h<hex(hostname)>.<rand>.dns.gl0b.xyz`). The DNS query name itself carries the host identifier off the machine, so exfiltration succeeds regardless of resolution result. The scoped name and generic 'internal utility' metadata are consistent with a dependency-confusion reconnaissance beacon designed to enumerate reachable internal build environments.

    References: https://www.npmjs.com/package/@latlongid/location/v/1.0.1

    Affected packages

    Package

    Name: @latlongid/location

    Purl: pkg:npm/%40latlongid/location

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-12506 | CVE-DB