MAL-2026-17327

    Dashboard / Malicious Package / MAL-2026-17327

    MAL-2026-17327

    Published: 30 Sept 2026Last Modified: 30 Sept 2026

    Summary: Malicious code in exiouss (npm)

    Details: Source: amazon-inspector (43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805) main.js in [email protected] imports child_process and issues POST requests to hardcoded endpoints, including https://gemini.google.com and https://ipc.shadxino.internal (main.js around lines 368-386). The presence of an `ipc.shadxino.internal` destination alongside a public Google host, combined with child_process usage and repeated `ping` invocations across the file (lines 202, 340, 420, 583, 611), fits an active-exfiltration/reconnaissance shape rather than any documented HTTP-client behavior. The `.internal` host is not a resolvable public destination and its appearance in a published npm module is consistent with an attacker-side collector or a leaked internal C2 name.

    References: https://www.npmjs.com/package/exiouss/v/5.0.1

    Affected packages

    Package

    Name: exiouss

    Purl: pkg:npm/exiouss

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.1