MAL-2026-5412

    Dashboard / Malicious Package / MAL-2026-5412

    MAL-2026-5412

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in @klapp-kyc/routes (npm)

    Details: Source: amazon-inspector (ca32e3aa7685d93e36eca726e08096bd0c5ba425172ef254fdf769cc09b46887) On `npm install`, the package's preinstall hook executes `node index.js`, which collects the installer's hostname, OS username, current working directory, __dirname, and package name, then exfiltrates them through two channels unconditionally: (1) a hex-encoded DNS A-record query to a subdomain of `d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (an interactsh-style out-of-band collector), and (2) an HTTP POST of a JSON payload to `http://172.201.213.59:9090/c`. The package has no other functionality — `package.json` declares `description: "security research"`, version `99.0.0` (dependency-confusion-style high version), and a KYC-themed scope (`@klapp-kyc/routes`) suggesting targeted reconnaissance against a specific organization's internal namespace. Regardless of the self-description, installers' internal host identifiers are leaked to attacker-controlled infrastructure.

    References: https://www.npmjs.com/package/@klapp-kyc/routes/v/99.0.1, https://www.npmjs.com/package/@klapp-kyc/routes/v/99.0.0

    Affected packages

    Package

    Name: @klapp-kyc/routes

    Purl: pkg:npm/%40klapp-kyc%2Froutes

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    99.0.0
    MAL-2026-5412 | CVE-DB