MAL-2026-4877

Dashboard / Malicious Package / MAL-2026-4877

MAL-2026-4877

Summary: Malicious code in @car-loans/restore (npm)

Details: Part of a dependency confusion attack campaign targeting the `@car-loans`, `@fb-deposit`, and `@debit-ib` npm scopes. The attacker (npm user **pik-libs**) published 25 scoped packages at the inflated version `99.99.99`, which resolves ahead of any private registry version via npm's default version resolution, silently hijacking installs of internal packages. The campaign shares infrastructure (`https://oob.moika.tech`) and an identical postinstall payload with a concurrent campaign by npm user **mr.4nd3r50n**. On installation, the `postinstall` hook executes `scripts/postinstall.js`. The script waits 3 seconds (sandbox evasion), then downloads an OS-specific second-stage JavaScript payload from `https://oob.moika.tech/payload/{mac|win|linux}.js`, writes it to a temporary file in the system temp directory, and spawns it as a detached Node.js process that continues running after npm exits. The payload exfiltrates the full `process.env` (environment variables including secrets, tokens, and credentials), along with hostname, username, platform, architecture, and working directory, to the C2 endpoint `https://oob.moika.tech/report`. If the second-stage download fails, a fallback beacon containing the same system details is sent to the same endpoint.

References: https://safedep.io/oob-moika-tech-dependency-confusion-campaign/