MAL-2026-5537

    Dashboard / Malicious Package / MAL-2026-5537

    MAL-2026-5537

    Published: 11 Jun 2026Last Modified: 11 Jun 2026

    Summary: Malicious code in @entos-ems/xerxes-client-js (npm)

    Details: Source: amazon-inspector (5632d30e60b3bb5fc5d731458a7c2972bd356c3ec1a9e8064df135359ee4ec7b) On `npm install`, package.json's `preinstall: node index.js` hook fires automatically and runs a reconnaissance beacon. index.js collects host identifiers (os.hostname(), process.platform, arch, home directory, username/uid/gid/shell, OS info, cwd) and the output of shell commands `whoami` and `id` (executed via child_process.exec), then POSTs the JSON payload to a hardcoded Burp Collaborator (oastify.com) subdomain at https://98fmeiqizlsgqr14stq21w67ryxplf94.oastify.com/detox56. The package targets the @entos-ems scope and ships no functional client code, consistent with a dependency-confusion attack against an internal namespace.

    References: https://www.npmjs.com/package/@entos-ems/xerxes-client-js/v/10.10.11

    Affected packages

    Package

    Name: @entos-ems/xerxes-client-js

    Purl: pkg:npm/%40entos-ems%2Fxerxes-client-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.10.11
    MAL-2026-5537 | CVE-DB