MAL-2026-4632

    Dashboard / Malicious Package / MAL-2026-4632

    MAL-2026-4632

    Published: 22 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in orca-website (npm)

    Details: Source: amazon-inspector (c52f7fe46d56cb45880942f5266494a2654d9d330914a6c3c99f02045eacd1dc) On require()/import, index.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), process.cwd(), process.pid, timestamp) and sends them as URL query parameters via HTTPS GET to a hardcoded Project Discovery Interactsh out-of-band collaborator at vwfmeddcdgidvdwpkigkg0l8us5vf3wtx.oast.fun. The package's stated name ('orca-website') has no relationship to host telemetry; package.json carries empty author, description, and keywords. Any consumer that imports this package unconditionally leaks installer-side host identification to an attacker-controlled OOB domain typically used for reconnaissance / dependency-confusion probing.

    References: https://www.npmjs.com/package/orca-website/v/1.0.0

    Affected packages

    Package

    Name: orca-website

    Purl: pkg:npm/orca-website

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0