MAL-2026-14161

    Dashboard / Malicious Package / MAL-2026-14161

    MAL-2026-14161

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm)

    Details: Source: amazon-inspector (69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159) The package's package.json declares a preinstall script that runs index.js automatically on `npm install`. index.js shells out via child_process.exec to collect the installer's hostname, current working directory, username, a package marker, and the machine's public IP (fetched via curl to ifconfig.me). The aggregated output is hex-encoded with xxd and split into DNS labels queried via nslookup against subdomains of snurkeburk.com, a DNS-tunnel exfiltration channel that bypasses egress HTTP filtering. Installing this package causes host identifiers and public IP to leave the machine to an attacker-controlled DNS namespace.

    References: https://www.npmjs.com/package/@sidp-kiosk/test-npm-snurkeburk-hackerone/v/2.999.0, https://www.npmjs.com/package/@sidp-kiosk/test-npm-snurkeburk-hackerone/v/1.999.0

    Affected packages

    Package

    Name: @sidp-kiosk/test-npm-snurkeburk-hackerone

    Purl: pkg:npm/%40sidp-kiosk/test-npm-snurkeburk-hackerone

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.999.0
    MAL-2026-14161 | CVE-DB