MAL-2026-6352

    Dashboard / Malicious Package / MAL-2026-6352

    MAL-2026-6352

    Published: 23 Jun 2026Last Modified: 23 Jun 2026

    Summary: Malicious code in hex-conv-ae7a (npm)

    Details: Source: amazon-inspector (35d4f6adb1ef40a529deec65b7409b949cd93ad60d6cf3880ff5e8f0079fef1f) The package's package.json declares a postinstall hook ("postinstall": "node run.js") that runs run.js automatically on npm install. run.js imports os, fs, http, https, and child_process and collects host identity and environment data including os.hostname(), os.userInfo(), os.platform(), process.env.USER, and process.cwd(), reads files from the filesystem (fs.readFileSync, fs.existsSync), base64-encodes payloads via Buffer.from(...).toString('base64'), and POSTs the result over http/https to a remote endpoint. This is the canonical install-time host-reconnaissance and exfiltration shape: a default `npm install` of this package automatically sends installer machine information off-host without any user interaction or documented purpose. The package name (hex-conv with a random hex suffix) is consistent with throwaway/disposable squatting infrastructure and the package has no legitimate library functionality matching this behavior.

    References: https://www.npmjs.com/package/hex-conv-ae7a/v/1.0.0

    Affected packages

    Package

    Name: hex-conv-ae7a

    Purl: pkg:npm/hex-conv-ae7a

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0