MAL-2026-12792
Dashboard / Malicious Package / MAL-2026-12792
MAL-2026-12792
Summary: Malicious code in gs-uitk-testing-utils (npm)
Details: Source: amazon-inspector (58475142ea32c554345513c67fd5ed8a8d6b60fb151e675249e4eb83984c8300) [email protected] declares an npm install lifecycle script (scripts.install='node index.js') that loads lib/core.js. That module collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), and the basename of the current working directory (process.cwd()), joins them with a hardcoded campaign marker 'goldman2' and a timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz, leaking host-identifying data over DNS. The destination domain, the target module names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd'), and the marker are reconstructed at runtime from char-code arrays in lib/b02e30.js and lib/6ad264.js to hide them from static inspection. The package name mimics an internal 'gs-uitk-*' UI-toolkit namespace and pairs with the marker 'goldman2' and an author email at the same sl4x0.xyz domain used for exfiltration, consistent with dependency-confusion reconnaissance against a specific organization. The exfiltration fires automatically on `npm install` and on require of the package.
Affected packages
Package
Name: gs-uitk-testing-utils
Purl: pkg:npm/gs-uitk-testing-utils
Affected ranges
Type: N/A
Events:
