MAL-2026-12795

    Dashboard / Malicious Package / MAL-2026-12795

    MAL-2026-12795

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in knowledge-grader (npm)

    Details: Source: amazon-inspector (74d01af74706eee07fb8ed306ec3b830641f63b4c055d605026edff65fd11c8f) The package's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, package path, and the contents of /etc/passwd and /etc/hosts, then HTTPS-POSTs the JSON payload to the hardcoded Burp Collaborator subdomain tebdjgz4guem6t74pf6iyowyjppgd71w.oastify.com. This fires automatically on npm install with no user interaction.

    References: https://www.npmjs.com/package/knowledge-grader/v/1.0.1

    Affected packages

    Package

    Name: knowledge-grader

    Purl: pkg:npm/knowledge-grader

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1