MAL-2026-6127

    Dashboard / Malicious Package / MAL-2026-6127

    MAL-2026-6127

    Published: 18 Jun 2026Last Modified: 18 Jun 2026

    Summary: Malicious code in @onum-releases/utils (npm)

    Details: Source: amazon-inspector (887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8) On require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastify.com', leaking the installer's hostname via DNS and HTTP to an out-of-band collaborator endpoint controlled by the package publisher. The beacon fires unconditionally on module load, so any consumer that imports the package exposes its host identifier to the attacker-controlled collaborator. The package.json description claims 'Security PoC placeholder - benign, no runtime payload', directly contradicting the shipped code. The scope '@onum-releases' impersonates the Onum vendor namespace, consistent with a dependency-confusion lure aimed at that organization's developers.

    References: https://www.npmjs.com/package/@onum-releases/utils/v/1.0.1, https://www.npmjs.com/package/@onum-releases/utils/v/1.0.2

    Affected packages

    Package

    Name: @onum-releases/utils

    Purl: pkg:npm/%40onum-releases%2Futils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2
    MAL-2026-6127 | CVE-DB