MAL-2026-17190

    Dashboard / Malicious Package / MAL-2026-17190

    MAL-2026-17190

    Published: 26 Sept 2026Last Modified: 26 Sept 2026

    Summary: Malicious code in cma-self-hosted-sandbox-cf (npm)

    Details: Source: amazon-inspector (d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35) package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home directory, configured DNS servers, and the contents of /etc/passwd and /etc/hosts, then HTTPS POSTs the JSON payload to the hardcoded Burp Collaborator subdomain 49bl3t5yt786ymbtth24nnlbs2ytmka9.oastify.com. The behavior fires automatically on install with no user interaction, the destination is an attacker-controlled out-of-band interaction host unrelated to any legitimate package function, and the collected data comprises installer-side system identifiers and local account/host files. This is a dependency-confusion/recon exfiltration payload with no other functionality present in the package.

    References: https://www.npmjs.com/package/cma-self-hosted-sandbox-cf/v/1.0.0

    Affected packages

    Package

    Name: cma-self-hosted-sandbox-cf

    Purl: pkg:npm/cma-self-hosted-sandbox-cf

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0