MAL-2026-5407

    Dashboard / Malicious Package / MAL-2026-5407

    MAL-2026-5407

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in @card-pci-data/store (npm)

    Details: Source: amazon-inspector (9a82d7b7e7588c4b773e2948eb1707e62f2fcece2bec37a23eda5d5058eae871) On `npm install`, the package's preinstall hook (`scripts.preinstall: node index.js || true`) runs index.js which collects host identity — `os.hostname()`, `os.userInfo().username`, `__dirname`, and `process.cwd()` — and exfiltrates it through two channels: (1) an HTTP POST to the hardcoded bare IP `172.201.213.59:9090/c`, and (2) a DNS resolution of a hex-encoded label appended to `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (an interactsh-style out-of-band beacon). The package has no advertised functionality beyond this beacon; its description is `security research` and the scoped name `@card-pci-data/store` impersonates payment-card / PCI-related tooling, consistent with a dependency-confusion or namespace-abuse lure. This auto-executes on default install and produces clear attacker benefit (installer host fingerprint delivered to attacker-controlled infrastructure).

    References: https://www.npmjs.com/package/@card-pci-data/store/v/99.0.1, https://www.npmjs.com/package/@card-pci-data/store/v/99.0.0

    Affected packages

    Package

    Name: @card-pci-data/store

    Purl: pkg:npm/%40card-pci-data%2Fstore

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    99.0.0