MAL-2026-4530

    Dashboard / Malicious Package / MAL-2026-4530

    MAL-2026-4530

    Published: 21 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in cloudsmith-vsc (npm)

    Details: Source: amazon-inspector (2b49ad4432747f754181e7a8428aff5fd2613f9d86283f05a04c2dd1f9ac2f2f) package.json declares a preinstall hook (`"preinstall": "node index.js"`) that runs automatically on `npm install`. index.js reads installer-side system identity and files — `os.hostname()`, `os.userInfo()`, homedir, DNS configuration, package metadata, `/etc/passwd`, and `/etc/hosts` — and POSTs them over HTTPS to a hardcoded Burp Collaborator subdomain (`6hoa7n94q5v6yig1hqokwg6f066zupie.oastify.com`). The package metadata is empty (no description, author, or license) and the name impersonates the Cloudsmith vendor brand, consistent with a dependency-confusion / typosquat recon-and-exfil payload. Any machine that installs this package transmits host fingerprinting and local account data to the attacker.

    References: https://www.npmjs.com/package/cloudsmith-vsc/v/2.1.2

    Affected packages

    Package

    Name: cloudsmith-vsc

    Purl: pkg:npm/cloudsmith-vsc

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.1.2
    MAL-2026-4530 | CVE-DB