MAL-2026-16175

    Dashboard / Malicious Package / MAL-2026-16175

    MAL-2026-16175

    Published: 15 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in csa-mfa (npm)

    Details: Source: amazon-inspector (959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9) package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command substitution of whoami, ls, and hostname. On npm install this automatically transmits the installer's username, current-directory listing, and hostname to a hardcoded bare-IP HTTP endpoint unrelated to any legitimate publisher infrastructure. There is no functional package purpose served by this behavior. Source: ossf-package-analysis (a11e3bfb8822762235630fbc44ccd99a2ccd272eba3f16bf242b74c4eb1cdc86) The OpenSSF Package Analysis project identified 'csa-mfa' @ 1.1.16 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/csa-mfa/v/1.1.15, https://www.npmjs.com/package/csa-mfa/v/1.1.16

    Affected packages

    Package

    Name: csa-mfa

    Purl: pkg:npm/csa-mfa

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.15
    1.1.16