MAL-2026-15687

    Dashboard / Malicious Package / MAL-2026-15687

    MAL-2026-15687

    Published: 24 Aug 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in @yuva2210/okx-poc-rce-impact (npm)

    Details: Source: amazon-inspector (1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124) @yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's `package.json` declares a `preinstall` script that runs on `npm install` and executes `child_process.execSync` calls for `whoami`, `hostname`, `pwd`, and `id`, collecting installer host and user identifiers and writing them to `/tmp/okx-poc-rce-proof.json`. The package has no other functional content — `index.js` is empty — so the tarball's only effect on installation is to execute the reconnaissance payload on the installer's machine. Any developer or build system that inadvertently resolves an OKX-internal name to this public package runs arbitrary code at install time. The self-labeled 'harmless PoC' framing does not change the mechanism: unsolicited command execution and host-identifier collection fire automatically on `npm install`.

    References: https://www.npmjs.com/package/@yuva2210/okx-poc-rce-impact/v/2.0.0

    Affected packages

    Package

    Name: @yuva2210/okx-poc-rce-impact

    Purl: pkg:npm/%40yuva2210/okx-poc-rce-impact

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.0
    MAL-2026-15687 | CVE-DB