MAL-2026-6254

Dashboard / Malicious Package / MAL-2026-6254

MAL-2026-6254

Summary: Malicious code in zomato-sushi (npm)

Details: Source: amazon-inspector (6f631d7af366bbb607f9088550a64939e395d0ce1199777828269de5772d860c) package.json declares a preinstall script that runs curl with form-encoded fields carrying the installer's hostname (`hostname -f`), `whoami`, current working directory, and a base64-encoded dump of the entire process environment (`env | base64 -w0`) over plain HTTP to an Interactsh/OAST out-of-band collector at `d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site`. A preuninstall hook beacons the same host. This fires automatically on `npm install` with no user opt-in. The bulk environment dump captures any secrets present in the shell at install time, including CI tokens, NPM_TOKEN, AWS_* keys, and similar credentials. The package name mimics Zomato's design system namespace and the shipped index.js is a stub with no functionality, consistent with a reconnaissance/credential-capture lure rather than a real library. Source: ossf-package-analysis (d19be1ee4f53b1ec4844c228d9522d737756870743ef43a9d00816950b449233) The OpenSSF Package Analysis project identified 'zomato-sushi' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/zomato-sushi/v/1.0.0