MAL-2026-3810

Dashboard / Malicious Package / MAL-2026-3810

MAL-2026-3810

Summary: Malicious code in @pluxee-connect/account-db-api-client (npm)

Details: Source: amazon-inspector (49a36af66b1c55fbf7a78529c1fe2d15b819cef018300a03cdc8e0a1b59f36c9) Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install`, reads os.hostname(), os.userInfo().username, process.version, and the package name and transmits them to the third-party OAST domain `d84t2rmqt3fpphmbii3gf9sdi63c3gkp7.oast.online` over both HTTP GET (port 80) and DNS lookup. The package's main entry (index.js) is a placeholder stub containing only a ConsentsStatus enum with a comment self-describing it as a `PoC stub` mirroring the real package's API. The combination of an inflated 99.0.0 version, a hollow API surface, and an unconditional install-time beacon to an interactsh out-of-band exfiltration host on a scope that resembles an internal Pluxee namespace is a textbook dependency-confusion attack: any build system misresolving the internal name to this public package leaks host identity to the attacker's OAST listener. Source: ossf-package-analysis (b7d101dbff5c071f3bab34e97f3d340e0b52caa00e38ef82e630864d44a7dce3) The OpenSSF Package Analysis project identified '@pluxee-connect/account-db-api-client' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/@pluxee-connect/account-db-api-client/v/99.0.0, https://www.npmjs.com/package/@pluxee-connect/account-db-api-client/v/99.0.1