MAL-2026-6370

Dashboard / Malicious Package / MAL-2026-6370

MAL-2026-6370

Summary: Malicious code in hyperpure (npm)

Details: Source: amazon-inspector (96c5552a039e4d845c30fae8f2c376eed21309d6b5298193850594fe4b1854d0) On `npm install`, the preinstall lifecycle script in package.json runs `curl` to POST the installer's hostname (`hostname -f`), current user (`whoami`), working directory (`pwd`), and a base64-encoded dump of the entire process environment (`env | base64 -w0`) over plain HTTP to `http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site`, an interactsh-style out-of-band collector domain. The dumped environment commonly includes CI tokens, cloud credentials (AWS_*, GCP, Azure), npm publish tokens, and other secrets present at install time, so any installer running `npm install hyperpure` discloses those secrets to an attacker-controlled listener. The package itself is otherwise hollow — index.js only exports `{ name: 'hyperpure', version: '1.0.0' }` — and the package metadata claims to be Zomato's internal `hyperpure` restaurant-supply-chain library, matching the shape of a dependency-confusion attack against an internal package name. The harm fires automatically on default install with no user opt-in.

References: https://www.npmjs.com/package/hyperpure/v/1.0.0, https://github.com/advisories/GHSA-q5m5-95fv-6hgf