MAL-2026-14428

    Dashboard / Malicious Package / MAL-2026-14428

    MAL-2026-14428

    Published: 24 Aug 2026Last Modified: 24 Aug 2026

    Summary: Malicious code in consumerweb-serverutils (npm)

    Details: Source: amazon-inspector (04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349) consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working directory, walks up the directory tree to read the enclosing project's package.json (name, author, version), hex-encodes the aggregated JSON, splits it into 60-character chunks, and exfiltrates it as DNS label queries to the attacker-controlled zone o.jgl.red (observed subdomain da5u87oh92rc72pp1dngqfc6hp8gwshm6.o.jgl.red). A fallback dns.lookup using the hostname is issued on error. Use of DNS as the transport bypasses HTTP egress controls and covers the payload on the wire, and the parent-package walk enables dependency-confusion targeting of the installer's private/internal package names.

    References: https://www.npmjs.com/package/consumerweb-serverutils/v/3.4.3

    Affected packages

    Package

    Name: consumerweb-serverutils

    Purl: pkg:npm/consumerweb-serverutils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.4.3
    MAL-2026-14428 | CVE-DB