MAL-2026-14536

    Dashboard / Malicious Package / MAL-2026-14536

    MAL-2026-14536

    Published: 26 Aug 2026Last Modified: 26 Aug 2026

    Summary: Malicious code in mt-ts-serverless-starter (npm)

    Details: Source: amazon-inspector (53da5b8989180a10122e1e8ab801ab76dc7587761bb58d05377359b8f8e09d52) package.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com. The exfiltration fires unconditionally at install time with no user interaction.

    References: https://www.npmjs.com/package/mt-ts-serverless-starter/v/1.0.1

    Affected packages

    Package

    Name: mt-ts-serverless-starter

    Purl: pkg:npm/mt-ts-serverless-starter

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-14536 | CVE-DB