MAL-2026-4633

    Dashboard / Malicious Package / MAL-2026-4633

    MAL-2026-4633

    Published: 22 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in osep-api-hub-service-client-v1 (npm)

    Details: Source: amazon-inspector (cd131719d20e013a4627e1ea402ffc26135d66a5d6dd35669b8a3a6fb85e5f76) package.json declares `"preinstall": "node index.js"`, causing index.js to run automatically on `npm install`. index.js collects host identifiers — `os.hostname()`, `os.userInfo()` (username/uid/gid/shell), `os.homedir()`, `process.platform`, `process.arch`, `process.cwd()` — and additionally shells out via `child_process` to `whoami` and `id`. The collected JSON is POSTed to the hardcoded URL `https://0pqbxi1hplohnif3fa7tyc1at1zsnobd.oastify.com/detox56`, a Burp Collaborator (oastify.com) subdomain controlled by whoever published the package. The package name mimics an internal-sounding scoped client and ships with empty author/description metadata, consistent with a dependency-confusion attack targeting a private package namespace. Any developer or CI system that installs this package immediately leaks host and user identity to the attacker's Collaborator endpoint.

    References: https://www.npmjs.com/package/osep-api-hub-service-client-v1/v/10.9.1

    Affected packages

    Package

    Name: osep-api-hub-service-client-v1

    Purl: pkg:npm/osep-api-hub-service-client-v1

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.9.1
    MAL-2026-4633 | CVE-DB