MAL-2026-4263

Dashboard / Malicious Package / MAL-2026-4263

MAL-2026-4263

Summary: Malicious code in secdriven (npm)

Details: Source: amazon-inspector (e64bd0b65a5cddc6e2032cfdd0a23f06c980a25066490b223d07e1b2e4efe3d8) On `npm install`, postinstall.js executes `whoami` via child_process and reads os.hostname(), os.platform(), the working directory, and CI / GITHUB_REPOSITORY environment variables, then transmits them as query-string parameters in an HTTPS GET to a hardcoded interactsh subdomain (`lg5ys3jebfzwk366pilidbmah1nsbszh.oastify.com`) under the path `/google/secdriven/`. A DNS lookup using `whoami` output as a subdomain provides a fallback exfiltration channel. The package description ("Security research canary — Google") and README pointing at a Google CTF internal package.json indicate this is a dependency-confusion payload targeting Google's internal namespace; any installer whose resolver picks up this public name leaks host identity, username, working directory, and CI repository path to the third-party OOB-detection endpoint without consent. Whether published as research or attack, the installer-side effect is the same: unconsented identity-and-environment beacon at install time. Source: ossf-package-analysis (bafef125d75ec1f8f8b4d9c19e43da29dc8efccecdab347c19a74d1602433535) The OpenSSF Package Analysis project identified 'secdriven' @ 1.0.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/secdriven/v/1.0.8, https://www.npmjs.com/package/secdriven/v/1.0.1, https://www.npmjs.com/package/secdriven/v/1.0.7