MAL-2026-5414

Dashboard / Malicious Package / MAL-2026-5414

MAL-2026-5414

Summary: Malicious code in @klapp-login-platform/oidc (npm)

Details: Source: amazon-inspector (6c2b86b9675d4d22e101f4f10f521cc36069ecebd1680d4c3ecfa0c04e8169da) On `npm install`, the package executes `node index.js` via its preinstall hook. index.js collects the installer's hostname (`os.hostname()`), username (`os.userInfo().username`), package directory (`__dirname`), and current working directory (`process.cwd()`), serializes them to JSON, hex-encodes the payload, and exfiltrates it through two channels: (1) a DNS resolution of a subdomain under `d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (interactsh-style out-of-band exfiltration), and (2) an HTTP POST to the bare IP `172.201.213.59:9090/c`. The package ships no documented functionality matching its `@klapp-login-platform/oidc` name; the description is 'security research'. The high version number (99.0.2) under an org-style scope on the public registry is consistent with a dependency-confusion attack designed to pre-empt resolution of an internal private package of the same name, and the beaconing payload provides the attacker with confirmation of which organizations have resolved the public version.

References: https://www.npmjs.com/package/@klapp-login-platform/oidc/v/99.0.2, https://www.npmjs.com/package/@klapp-login-platform/oidc/v/99.0.0