MAL-2026-5413

    Dashboard / Malicious Package / MAL-2026-5413

    MAL-2026-5413

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in @klapp-login-platform/native-sdk (npm)

    Details: Source: amazon-inspector (3b3bc8633d15b44abc90074d3362fd9399f53d10a88e24264caee9d924a72bb6) On `npm install`, the package's `preinstall` lifecycle hook runs `node index.js`, which collects installer-side identifiers — `os.hostname()`, `os.userInfo().username`, `__dirname`, `process.cwd()`, and the package name — and exfiltrates them through two channels. First, the JSON payload is hex-encoded into DNS labels and resolved under `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live`, an out-of-band collector. Second, the same JSON is POSTed to a bare IP `http://172.201.213.59:9090/c`. Neither destination matches any documented vendor SDK endpoint. The package metadata reinforces malicious intent: the scope `@klapp-login-platform` resembles an internal namespace, the description is `security research`, and the version `99.0.2` is inflated to win dependency-confusion resolution against a private package. Installing the package immediately leaks host identity to attacker-controlled infrastructure.

    References: https://www.npmjs.com/package/@klapp-login-platform/native-sdk/v/99.0.2, https://www.npmjs.com/package/@klapp-login-platform/native-sdk/v/99.0.0

    Affected packages

    Package

    Name: @klapp-login-platform/native-sdk

    Purl: pkg:npm/%40klapp-login-platform%2Fnative-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.2
    99.0.0