MAL-2026-14205

    Dashboard / Malicious Package / MAL-2026-14205

    MAL-2026-14205

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in @sarex-team/translator (npm)

    Details: Source: amazon-inspector (0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6) The package's install lifecycle script (scripts.install="node index.js") automatically executes on npm install and loads lib/core.js. That module reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates them with a timestamp as subdomain labels, and issues a dns.resolve4 lookup against oob.sl4x0.xyz — encoding the installer's identity into a DNS query that reaches the attacker's authoritative nameserver. The destination domain, the module names ('os', 'dns', 'process'), and the accessor names ('userInfo', 'hostname', 'cwd') are reconstructed at runtime from char-code arrays in hex-named files (lib/b02e30.js, lib/6ad264.js), concealing the exfiltration path from casual review. The exfil domain sl4x0.xyz matches the package author's contact email ([email protected]), confirming the destination is author-controlled.

    References: https://www.npmjs.com/package/@sarex-team/translator/v/9.9.11

    Affected packages

    Package

    Name: @sarex-team/translator

    Purl: pkg:npm/%40sarex-team/translator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.9.11
    MAL-2026-14205 | CVE-DB