MAL-2026-16153

    Dashboard / Malicious Package / MAL-2026-16153

    MAL-2026-16153

    Published: 14 Sept 2026Last Modified: 14 Sept 2026

    Summary: Malicious code in web-main (npm)

    Details: Source: amazon-inspector (61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2) package.json declares `preinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script collects os.hostname(), os.userInfo() (username/uid/gid/shell), platform, arch, homedir, and the stdout of `whoami`, `id`, and `pwd` via child_process.exec, then POSTs the aggregated JSON to a hardcoded endpoint at https://smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info (a Burp Collaborator out-of-band host). No legitimate functionality is present; the package's sole effect on install is host reconnaissance and exfiltration to an attacker-controlled OOB collector.

    References: https://www.npmjs.com/package/web-main/v/22.1.2

    Affected packages

    Package

    Name: web-main

    Purl: pkg:npm/web-main

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.1.2