MAL-2026-17746

    Dashboard / Malicious Package / MAL-2026-17746

    MAL-2026-17746

    Published: 9 Oct 2026Last Modified: 11 Oct 2026

    Summary: Malicious code in kmf-bootstrap (npm)

    Details: Source: amazon-inspector (b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74) On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npm_package_name and issues DNS resolutions for a label of the form <host>.<pkg>.db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me, leaking those identifiers to an Interactsh (oast.me) collaborator over DNS. Second, postinstall.js require()s a shipped Linux x64 native addon at prebuilds/linux-x64/addon.node that calls gethostname() and getpwuid()->pw_name and reads the npm_package_name and npm_config_registry environment variables, then opens a raw socket and sends an HTTP POST with body h=<host>&u=<user>&p=<pkg>&r=<registry> to the bare IP 64.181.165.115 (Host header 64.181.165.115, path /dc, HTTP/1.0, no TLS). The destination is a bare IP with no relation to the package publisher and the npm_config_registry value can disclose a private/internal registry URL from the installer's.npmrc. The native component is opaque code auto-executed during install with host-level network egress. The package name resembles the common 'bootstrap' naming convention, consistent with a dependency-confusion / typosquat lure whose purpose is to beacon successful installs and private registry metadata. Source: ossf-package-analysis (4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b) The OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/kmf-bootstrap/v/100.100.106, https://www.npmjs.com/package/kmf-bootstrap/v/100.100.101, https://www.npmjs.com/package/kmf-bootstrap/v/100.100.103, https://www.npmjs.com/package/kmf-bootstrap/v/100.100.102, https://www.npmjs.com/package/kmf-bootstrap/v/100.100.100

    Affected packages

    Package

    Name: kmf-bootstrap

    Purl: pkg:npm/kmf-bootstrap

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    100.100.102
    100.100.103
    100.100.106
    100.100.101
    100.100.100