MAL-2026-4626

Dashboard / Malicious Package / MAL-2026-4626

MAL-2026-4626

Summary: Malicious code in omnius (npm)

Details: Source: amazon-inspector (2aceac0879b587bc711c3f156bf0de4bab90f3774816a6cbeb36a2cf9bb03e12) The package's postinstall lifecycle hook launches dist/postinstall-daemon.cjs, which combines child_process.execSync, os.userInfo(), filesystem probes, and network primitives (require('http'), http.request, GET) consistent with a host-reconnaissance-and-exfiltration daemon. The script repeatedly invokes ping (5+ call sites at lines 184, 298, 465, 693, 741) for host/network discovery, and reads identity (os.userInfo at L160, L395) before sending HTTP requests. package.json declares both preinstall and postinstall hooks and additionally embeds curl invocations (line 142). A sibling Python script (dist/scripts/web_scrape.py) contains its own ping/wget/POST chain. The combination of: (a) a daemon installed via lifecycle hooks, (b) execSync-driven system enumeration, (c) outbound HTTP from install-time-reachable code, and (d) multiple curl shell-outs in package.json constitutes installer-side reconnaissance with network exfiltration. Installing this package will execute attacker-controlled probing/exfiltration on the installer's machine.

References: https://www.npmjs.com/package/omnius/v/1.0.153, https://www.npmjs.com/package/omnius/v/1.0.155, https://www.npmjs.com/package/omnius/v/1.0.147, https://www.npmjs.com/package/omnius/v/1.0.136, https://www.npmjs.com/package/omnius/v/1.0.145, https://www.npmjs.com/package/omnius/v/1.0.148, https://www.npmjs.com/package/omnius/v/1.0.140, https://www.npmjs.com/package/omnius/v/1.0.141, https://www.npmjs.com/package/omnius/v/1.0.157