MAL-2026-6993

    Dashboard / Malicious Package / MAL-2026-6993

    MAL-2026-6993

    Published: 8 Jul 2026Last Modified: 8 Jul 2026

    Summary: Malicious code in bytefaas-sdk (npm)

    Details: Source: amazon-inspector (07cb4f68cec68081ac4817ad2ae387e7b031d3377a74a74ecca59c5858940d08) Package published at version 9999.0.0 under the name `bytefaas-sdk`, the canonical dependency-confusion shape used to shadow a private internal package of the same name. `package.json` declares a `preinstall` hook that runs `callback.js`. On any `npm install`, callback.js collects the installer's `os.hostname()`, `os.userInfo().username`, platform, and cwd and transmits them to a third-party Interactsh (oast.fun) endpoint via both a DNS lookup (encoded subdomain) and an HTTPS POST. The HTTPS request sets `rejectUnauthorized: false`, disabling TLS certificate verification on the beacon. The package's README self-describes as a bug-bounty canary against TikTok's internal build systems, but the exfiltration fires unconditionally against any installer whose resolver picks up this public 9999.0.0 release — including unrelated organizations and CI systems. Cover-story framing does not change that non-consenting installers' host identifiers leak to a third-party server.

    References: https://www.npmjs.com/package/bytefaas-sdk/v/9999.0.0

    Affected packages

    Package

    Name: bytefaas-sdk

    Purl: pkg:npm/bytefaas-sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9999.0.0
    MAL-2026-6993 | CVE-DB