MAL-2026-16243

Dashboard / Malicious Package / MAL-2026-16243

MAL-2026-16243

Summary: Malicious code in idx_form_script (npm)

Details: Source: amazon-inspector (3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3) [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal package names. package.json declares a postinstall hook that runs callback.js, which auto-executes on npm install. callback.js requires os, https, http, and child_process, then calls collectSystemInfo() to gather os.userInfo, os.hostname, uid/gid, homedir, platform, cwd, local IP, and external IP (via https.get to api.ipify.org). It reads CI/CD credential environment variables including AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, DOCKER_PASSWORD, GITHUB_REPOSITORY, and GITHUB_ACTOR, and includes their values or presence flags in a JSON payload. The payload is POSTed to a hardcoded Discord webhook at discord.com/api/webhooks/1549797176794943579/..., with an additional DNS-based exfil channel. The package's self-labeling as an 'authorized PoC' is author-controlled cover-story text and does not change the observed behavior: any organization that resolves this name from the public registry will run installer-side reconnaissance and ship credential-context data to an attacker-controlled endpoint. Source: ossf-package-analysis (59d074c4d6bd941d9586764043d556a83d301711c58eb661d57d63fa06ebec60) The OpenSSF Package Analysis project identified 'idx_form_script' @ 999.0.4 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/idx_form_script/v/999.0.2, https://www.npmjs.com/package/idx_form_script/v/999.0.4