MAL-2026-14186

    Dashboard / Malicious Package / MAL-2026-14186

    MAL-2026-14186

    Published: 18 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in pump-segments-sdk (npm)

    Details: Source: amazon-inspector (838470d6049e677964786698e4a7a5dca5897ce2623d54a4c3e84510381e74e5) package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info, output of whoami/uname/id/ps aux, cwd, package.json, node_modules listing, /etc/passwd, /etc/shadow, ~/.npmrc, and ~/.npm/_logs, and POSTs the collected data over plain HTTP to a hardcoded oastify.com (Burp Collaborator) subdomain. The package presents itself as a netbsd-x64 esbuild build, which does not match the observed behavior. The read of ~/.npmrc exposes any npm auth tokens present on the installer host, and /etc/shadow read attempts to exfiltrate local password hashes.

    References: https://www.npmjs.com/package/pump-segments-sdk/v/20.1.1

    Affected packages

    Package

    Name: pump-segments-sdk

    Purl: pkg:npm/pump-segments-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    20.1.1
    MAL-2026-14186 | CVE-DB