MAL-2026-7011

    Dashboard / Malicious Package / MAL-2026-7011

    MAL-2026-7011

    Published: 8 Jul 2026Last Modified: 8 Jul 2026

    Summary: Malicious code in events-alias (npm)

    Details: Source: amazon-inspector (164642716a755117674746c1c2534b0ac47d56bed2348e7a800c3d37a98074e9) The package's preinstall hook ("node index.js") runs automatically on `npm install` and executes an exfiltration payload. index.js requires child_process, os, http, and https, collects the installer's hostname, platform, arch, home directory, user info (username/uid/gid/shell), the output of `whoami`/`id`, and cwd, then POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://s70v1tcmg3npuykzzok5t0tdz45vtlha.oastify.com/detox56. The package name 'events-alias' mimics the ubiquitous Node core 'events' module namespace but ships only this install-time recon/exfil payload; an undeclared ~10KB binary blob named 'i' also ships in the tarball but is not referenced from the executed code. Installing this package leaks installer identity/host reconnaissance data to attacker-controlled infrastructure.

    References: https://www.npmjs.com/package/events-alias/v/15.0.1

    Affected packages

    Package

    Name: events-alias

    Purl: pkg:npm/events-alias

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    15.0.1